MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b9baf1b41eab70fee9b51a4f1d42c57e360094bd3cbaa24a4d87f22ab528523. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b9baf1b41eab70fee9b51a4f1d42c57e360094bd3cbaa24a4d87f22ab528523
SHA3-384 hash: a39a15dc7402ed2837f94610f197768bb06243cc3d1f9b5fc046e2c7c0c8800458ea867fa8b503bd681c3e76412cb1b5
SHA1 hash: a6d69462c270a000f3dfefbbd70c53091a60c9d5
MD5 hash: d7e862b42b6b93253732abc9fbe21512
humanhash: earth-thirteen-grey-low
File name:PO #0545TF2124434364_docx.r12
Download: download sample
Signature Loki
Create hunting rule
File size:287'775 bytes
First seen:2022-03-04 06:36:37 UTC
Last seen:2022-04-20 09:47:17 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:W4uanvD7hrl7cz5VAZfjnCQx+3DYBVJHkwgzoXZxLfPAa2AUQENs:W4u4vD7hJwzfAVnCKuD0zgkXZx0tAUL6
TLSH T19A5423B8406DC92033A21CA107E5B8EED33C952D2D7512F3FDA0C5F9875F2A51A72B69
Reporter fabjer
Tags:Loki r12 rar

Intelligence

File Origin
# of uploads :
6
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b9baf1b41eab70fee9b51a4f1d42c57e360094bd3cbaa24a4d87f22ab528523/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-03-04 06:37:09 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
20 of 27 (74.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bon26g2b5k3q73u3kgspdvbmk7rwackl2pf2ujfe3b7sfk2squrq._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer suricata trojan
Link:
https://tria.ge/reports/220304-hdgsjafdcm/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Lokibot
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://164.90.194.235/?id=27496844121369087
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/0b9baf1b41eab70fee9b51a4f1d42c57e360094bd3cbaa24a4d87f22ab528523

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 0b9baf1b41eab70fee9b51a4f1d42c57e360094bd3cbaa24a4d87f22ab528523

(this sample)

Executable exe 27ca2c046dd43e3139368e543bbf8ff464b8d99b6a9b04eae485ae29b1a4ade1

Loki

Executable exe 35ef454a4a31bef1d7ffde27551478763d11bef0b3464edf537448f6cb9f73a6

  
Dropping
SHA256 35ef454a4a31bef1d7ffde27551478763d11bef0b3464edf537448f6cb9f73a6
  
Delivery method
Distributed via e-mail attachment

Comments