MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046
SHA3-384 hash: 3fc02172895d4c102fe72546b57683084d7a33f715128e71557a01b530fb93bc4539687a9e4dbf6e3950ef7d58f8a403
SHA1 hash: 3b2f329b207365d4d1eb69a75bb9a43ae5bf3c12
MD5 hash: 78d10b686503f8b21b0fa517e17fa39e
humanhash: charlie-twelve-avocado-carbon
File name:statement and Payment.xls.scr.exe
Download: download sample
Signature Loki
Create hunting rule
File size:281'088 bytes
First seen:2021-10-19 20:08:47 UTC
Last seen:2021-10-19 21:06:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:tcDq80iCKbDLJFBeECeHwOPMEfNXlTEGtxhy:tcDqLwrBedmwOUeNNVti
Threatray 5'375 similar samples on MalwareBazaar
TLSH T1CD548D52F6D4AB93F6BCE338609558074BFB8121C3DECD0B3E9742C2C4A6D468267E65
File icon (PE):PE icon
dhash icon 10f0c4c8c8c4f010 (26 x AgentTesla, 18 x Smoke Loader, 10 x Formbook)
Reporter James_inthe_box
Tags:exe Loki

Intelligence

File Origin
# of uploads :
2
# of downloads :
367
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/198664/
Detection(s):
SecuriteInfo.com.Variant.Bulz.822791.12261.26452.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a process
Creating a file in the %temp% directory
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6174f616db358dd15ed91071/reports/0dfc1f95-3067-422b-959c-8093b80b2cf5/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/33f10430-21ef-49fe-a1ed-c2a703f27b39
Result
Threat name:
AgentTesla Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/873772
Signature
.NET source code contains very large array initializations
Antivirus detection for dropped file
Antivirus detection for URL or domain
Executable has a suspicious name (potential lure to open the executable)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AgentTesla
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 506203 Sample: statement and Payment.xls.scr.exe Startdate: 20/10/2021 Architecture: WINDOWS Score: 100 37 mail.suissajoiers.com 2->37 39 iykl.xyz 2->39 49 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Antivirus detection for URL or domain 2->53 55 14 other signatures 2->55 8 statement and Payment.xls.scr.exe 1 2->8         started        signatures3 process4 file5 27 C:\...\statement and Payment.xls.scr.exe.log, ASCII 8->27 dropped 73 Injects a PE file into a foreign processes 8->73 12 statement and Payment.xls.scr.exe 71 8->12         started        17 powershell.exe 18 8->17         started        signatures6 process7 dnsIp8 43 172.67.166.190, 49757, 49761, 49763 CLOUDFLARENETUS United States 12->43 45 spartan.prynt.market 204.12.234.154, 49756, 49758, 49759 WIIUS United States 12->45 47 2 other IPs or domains 12->47 29 C:\Users\user\AppData\Roaming\sEKtIS1.exe, PE32 12->29 dropped 31 C:\Users\user\AppData\Roaming\aWdpNN1.exe, PE32 12->31 dropped 33 C:\Users\user\AppData\Roaming\OjwKRtt.exe, PE32 12->33 dropped 35 2 other malicious files 12->35 dropped 75 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->75 77 Tries to steal Mail credentials (via file access) 12->77 79 Tries to harvest and steal ftp login credentials 12->79 19 aWdpNN1.exe 6 12->19         started        23 OjwKRtt.exe 8 12->23         started        25 conhost.exe 17->25         started        file9 signatures10 process11 dnsIp12 57 Antivirus detection for dropped file 19->57 59 Multi AV Scanner detection for dropped file 19->59 61 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->61 71 4 other signatures 19->71 41 mail.suissajoiers.com 160.153.133.158, 49778, 49787, 49790 GODADDY-AMSDE United States 23->41 63 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 23->63 65 Tries to steal Mail credentials (via file access) 23->65 67 Machine Learning detection for dropped file 23->67 69 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 23->69 signatures13
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-10-19 20:08:38 UTC
AV detection:
17 of 44 (38.64%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b3bm53rxe5q3r2unehjx3c6ylg4p7kxq7lwjtho2kts37mw74bda._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
0300502f1a1664d90992dd340006df7c7852a2c33121e7ee95192ee0b0209fab
Loki
05679e77d92c8be217fb1e34cfaa8dc0254a98c9cd35ce0b0bbab31426daff1f
Loki
15b446aaa531cac9c5464d712493d14b892ef3cbf6a212b1f37a53c9f2015d2b
Loki
3dd38daa4ca8630ccda829c5d97e744ed278ddbf9c79161450cdb9517c74e027
Loki
895a3f8a366ed73ca1cab8ef49582ada6382880654ab28e95b2902cde46e3726
Loki
a358f9eb5bcd5300fa83d2080d4ec9f1996b5fedbc5b6f63a4d95738c8d99704
Loki
b65b34a54593add5ada0cc781f370a27c19af92ff0f2621b1539efd90a001cde
Loki
c1d9b04bca7264c76a2eae6357f6a2fc931237f374db992a926db9dd714b85c5
Loki
f228ebe1b6d660825c71c76528486d30fe68858362b0bab96a203b4eba670c35
Loki
fed21233449898cf24af01a24a9e552fa1c3f3684a4cc1411ae9240d1af5991b
Loki
+ 5'365 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer suricata trojan
Link:
https://tria.ge/reports/211019-yw4ysahccq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Drops startup file
Reads user/profile data of web browsers
Lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://iykl.xyz/Spartan3/w2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
569e9c61daa7c2c95fd3454da59e586a706c995fd625d0b523570bad72cf8fb1
MD5 hash:
9d609f6f0b87f9d74876e1de2f8ce95a
SHA1 hash:
d1734056e0936410abcfccdfb7bd2b558db271df
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/ffdf4313-3ee4-4cf5-bb99-fd5a6b8750b6/
SH256 hash:
fd56a07f2da75c84337cbf94e0acafc09fb909cfb187a0ae214827ce2c4708bb
MD5 hash:
d93c5f59ddc41313bf36f106a2f1fe17
SHA1 hash:
97c5cd9d0689c1cd74685bc979122a13eba3fcc9
Link:
https://www.unpac.me/results/ffdf4313-3ee4-4cf5-bb99-fd5a6b8750b6/
SH256 hash:
0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046
MD5 hash:
78d10b686503f8b21b0fa517e17fa39e
SHA1 hash:
3b2f329b207365d4d1eb69a75bb9a43ae5bf3c12
Link:
https://www.unpac.me/results/ffdf4313-3ee4-4cf5-bb99-fd5a6b8750b6/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0ec2ceee3727/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/198664/

Comments