MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0cd6273cb957d6e97a533d50c86de4980c956f55119bb511f17a5c0458f10f21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0cd6273cb957d6e97a533d50c86de4980c956f55119bb511f17a5c0458f10f21
SHA3-384 hash: 126740afcb42359a1adbb3bef0e7908f5dcebaca44ae36f0f56d1ff5141cab8cc9c74b961aab3178c637c60ff1229ad3
SHA1 hash: 97797cc5344a0b71479753a20647da90307e0366
MD5 hash: 0e0ade7b705176fd9730234e84a62b0f
humanhash: bacon-nitrogen-mississippi-glucose
File name:0e0ade7b705176fd9730234e84a62b0f.exe
Download: download sample
Signature Loki
Create hunting rule
File size:811'008 bytes
First seen:2023-03-13 01:45:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:4a/5u62iNgXs91dPNFfhxEvx8GlAjWRF6aBuukNNsN2j0loa:4a/5u61a8zfVkD+jWRFDu7ekj0lD
Threatray 3'981 similar samples on MalwareBazaar
TLSH T1F205BF9572B25423FC8F41BA192BE1DD2DB171437355E23B5B7B3AE1E2015BFB288602
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 00f0f4f4eca43600 (5 x Loki, 5 x SnakeKeylogger, 5 x AgentTesla)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://208.67.105.148/morgan/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
0e0ade7b705176fd9730234e84a62b0f.exe
Verdict:
Malicious activity
Analysis date:
2023-03-13 01:47:42 UTC
Tags:
trojan lokibot
Link:
https://app.any.run/tasks/02259964-0147-48e7-86cd-2c3af2a949be

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/373840/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Enabling the 'hidden' option for analyzed file
Moving of the original file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo formbook lokibot packed remcos
Link:
https://www.filescan.io/uploads/640e805c8cf57265b25ab65f/reports/c03f1566-f2d2-4f0f-8634-7ba1b8844c59/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/0cd6273cb957d6e97a533d50c86de4980c956f55119bb511f17a5c0458f10f21
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/486bbff8-4682-4831-9947-f63ce10014bf
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1192167
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0cd6273cb957d6e97a533d50c86de4980c956f55119bb511f17a5c0458f10f21/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2023-03-08 06:04:52 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
21 of 39 (53.85%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=btlcopfzk7los6sthvimq3petagjk32vcgn3keprpjoaiwhrb4qq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
04f557582bc8b4c4af843d0c837124da73f887ac5b997efdd78f96d45caced85
Loki
0f6a0c8f4c9d3fa419bd22b2687328e7a721ad0b1ef504a64166b1c630997cee
Loki
26cfdd614196dd8f128f01480c55504960ecafad60991455a030cc5c73130f2a
Loki
4e12ca0674f72503e00f35b8b27aa98da0855baa9e25264b357bb934e31a2217
Loki
594a574211cffc47d78817221315092ab978403b71e1ff43922286ec9f60e188
Loki
7f0fcb4f3651ec6a3b273322857afe8aa8373f77964afd0bb592378a4a97fe1a
Loki
83ce4d12583639df7dcbe4d13b6e608bca3c42a58dc4fbb18c352fa93dec7800
Loki
a1f8dd874a1d63dfbd2cc504fbe6d5784eb00610b02fef44b606b7a127f41bc4
Loki
+ 3'971 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/230313-b6zeqaab7s/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://208.67.105.148/morgan/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
df155d1131273c71ac518501f880ef5be67533e826f3b84c8b7b642c940289d1
MD5 hash:
6b1674df1c654f61c719dbe1b6f4d80b
SHA1 hash:
fb3725b94ff92b3a471a12e569fca65c26b67006
Link:
https://www.unpac.me/results/6f416b2a-feb2-41e0-ae69-4ca842ca2972/
SH256 hash:
ea1a5df9760d29610bea19018826a526e9f20fef5869a71755ebbc472d92f996
MD5 hash:
ca3952dc192a4d1f32eb879570cfae1b
SHA1 hash:
cae7b0394e0eb7781d365c88ba9cc010465cf3e3
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
Link:
https://www.unpac.me/results/6f416b2a-feb2-41e0-ae69-4ca842ca2972/
Parent samples :
0cd6273cb957d6e97a533d50c86de4980c956f55119bb511f17a5c0458f10f21
50ee6f613fdfbbe0ab3745d1641f98df80be37ab88bb587cde4baf3835e5637c
3ae26e4ae40658d87e41bc65a3a04a386d66e7802629c016b3453f536c632642
ac8856b90f8dc00344bab702e9ab5f5dfad41082ea44f3a42ec7a0a86a51d2da
31f19001d973bfaa236dffd2fb024efcbb775c76d3bd078c106be6d02df1f7d9
1e0557bb24ff7057aa35904c7ce0edf8cd20c7dee89bbcd9485cce5b04fb80ce
a0e358657312ddd1b269aae62b64c60ceb4df2a5a58335362379ee96afea23cd
SH256 hash:
3233ce92e1eb99edbcf13f7c46220b0454a797c1a5088e3df6ae205c52ff395e
MD5 hash:
e979eadace64ae61808464de50205b83
SHA1 hash:
8b7a23057c2fd3e744b7f0006acad594f23e58e0
Link:
https://www.unpac.me/results/6f416b2a-feb2-41e0-ae69-4ca842ca2972/
SH256 hash:
dd49948e0b3393a8b53084075ec2f2a8c36813d1ba1ca538697eb62ec4b4deae
MD5 hash:
538dab51e58b7dd3809664982f4d0746
SHA1 hash:
4e7f9615f1d96b087c453a72217662f867e0520d
Link:
https://www.unpac.me/results/6f416b2a-feb2-41e0-ae69-4ca842ca2972/
SH256 hash:
e386840537170219177c2bb3404f4c7bd9da1a2d53cdf2ae1e857c3b19628a29
MD5 hash:
d170ab8c03b9c37d5be449454db131d2
SHA1 hash:
2031b6754a65d21b47dd11a34fee86f048d6048d
Link:
https://www.unpac.me/results/6f416b2a-feb2-41e0-ae69-4ca842ca2972/
SH256 hash:
0cd6273cb957d6e97a533d50c86de4980c956f55119bb511f17a5c0458f10f21
MD5 hash:
0e0ade7b705176fd9730234e84a62b0f
SHA1 hash:
97797cc5344a0b71479753a20647da90307e0366
Link:
https://www.unpac.me/results/6f416b2a-feb2-41e0-ae69-4ca842ca2972/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0cd6273cb957/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/0cd6273cb957d6e97a533d50c86de4980c956f55119bb511f17a5c0458f10f21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/373840/

Comments