MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1065589a9340762824a0d03fff314f61e65083bf59cbc457e7ebb4986d871611. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 13

Intelligence 13 IOCs YARA 13 File information Comments

SHA256 hash:	1065589a9340762824a0d03fff314f61e65083bf59cbc457e7ebb4986d871611
SHA3-384 hash:	8ebccc818436a6d9e0ddf2c1ee1b3972c349f0c93d924686c091a19f7d0e896bfe923f4a88f903cb72264f9b3663e0fd
SHA1 hash:	4af1dd4745f60dac7ffd15fc66bd089adbd39834
MD5 hash:	6bc8fa374da2d5e4b76a242efa7e9907
humanhash:	edward-minnesota-minnesota-sodium
File name:	RFQ 350993.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	821'248 bytes
First seen:	2022-06-29 02:17:48 UTC
Last seen:	2022-06-29 13:36:31 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:NgQ07f6EgAkrcz9V/xhcSTB5v6knHCnTRdweuGY7O6YRw0DaPCi1:NKzkwz9V/xiOB51G0lG/q0Ji
Threatray	8'335 similar samples on MalwareBazaar
TLSH	T1DE05BE5467D89EE7D86A037DF051290953B2F261A357E78B87A8B0F9BCA23D0CC50787
TrID	61.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.0% (.SCR) Windows screen saver (13101/52/3) 8.8% (.EXE) Win64 Executable (generic) (10523/12/4) 5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	GovCERT_CH
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

262

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/284080/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Sending a custom TCP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a process from a recently created file

Creating a process with a hidden window

Creating a file in the %temp% directory

Launching a process

Unauthorized injection to a recently created process

Creating a file

Reading critical registry keys

Changing a file

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for analyzed file

Using the Windows Management Instrumentation requests

Stealing user critical data

Moving of the original file

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/62bbb698197c837506ce95b6/reports/4111b16a-0238-436b-a442-d8b11cfb40da/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a1d2d562-f2a3-4766-9fa9-bf8bd1a72c46

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1021574

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Generic Downloader

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/1065589a9340762824a0d03fff314f61e65083bf59cbc457e7ebb4986d871611/

Threat name:

ByteCode-MSIL.Trojan.LokiBot

Status:

Malicious

First seen:

2022-06-29 01:52:44 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 40 (50.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=cbsvrgutib3cqjfa2a776mkpmhtfba57lhf4iv7h5o2jq3mhcyiq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220629-cq9q7afgg8/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Fake 404 Response

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://185.102.170.20/demo/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

5723367d7cd48b98eb468740ee30085b10bfa3d6a9774e36936e6026aa58af05

MD5 hash:

ccb0686ddfcd782f6adaab81f29a9348

SHA1 hash:

fb2138780442d54c9b367ae901c7150c1d21f087

Link:

https://www.unpac.me/results/218ed85c-4c6c-48aa-bc24-fe9d95c98139/

SH256 hash:

0cb6aef1fa57d11408e47ae071485ef8f48c2982997b8d74b47a4151d85b978c

MD5 hash:

843aa6edf83bff7b61c6a5369ef41e95

SHA1 hash:

d1bfeec8eaac9a1dacf2f7062ce964d8e7d77085

Link:

https://www.unpac.me/results/218ed85c-4c6c-48aa-bc24-fe9d95c98139/

SH256 hash:

b3e5cbb80a19e5bbd5ca27b7e8a9c05b4fd70309b73b54b458e82db2ffc8b865

MD5 hash:

bb1e8bf018379b3f96f122372dcd22f1

SHA1 hash:

93c4543963997415350dda38815ab2e47f6c5693

Detections:

win_lokipws_g0

win_lokipws_auto

lokibot

Link:

https://www.unpac.me/results/218ed85c-4c6c-48aa-bc24-fe9d95c98139/

Parent samples :

b66327c53adb06f067e45a7763f760aa5a240ec7a8436a0240246ff858c81f5c
1065589a9340762824a0d03fff314f61e65083bf59cbc457e7ebb4986d871611
ebf17062065528a741f635ddbfa773618c23060a96609ce130bddffce137693a
762e0b4b5ac10ebdfa880cdca1989f607cb623a0a58292bd2424314378b04e81
1a63f65bcede3af088e7418ab0ba5a8be2fe254875571e73b32187bb84e4f701
ac6244801e7bc28902f33c0c292da8616933677c58d190ca662f1afc731af60c
ac66eeb17fb8028ffeb839cfa6815679b06ec2bbd6e43e8c3bba052d057ff6be
339977335a0e4a0029c4484e7067b2e1a18f29bcbc27a90b639d6c24daa88803

SH256 hash:

89f8f7152c68a9c5f907533b9de192ba93eff06735eb30905c68184c048f991f

MD5 hash:

fc48170ad9b6a6b74a50c28a0a519f2b

SHA1 hash:

0970886b9d7d8e134d0448b7f64c0084e351800e

Link:

https://www.unpac.me/results/218ed85c-4c6c-48aa-bc24-fe9d95c98139/

SH256 hash:

4162806916c00ea40680ed72c19fb9a4f5c6e645098ca306a8df36543c4ce413

MD5 hash:

1ff74e10f25d3c06e32926e02446e2fc

SHA1 hash:

0954ab64f2418b3d07d941a8dee6622142747365

Link:

https://www.unpac.me/results/218ed85c-4c6c-48aa-bc24-fe9d95c98139/

SH256 hash:

1065589a9340762824a0d03fff314f61e65083bf59cbc457e7ebb4986d871611

MD5 hash:

6bc8fa374da2d5e4b76a242efa7e9907

SHA1 hash:

4af1dd4745f60dac7ffd15fc66bd089adbd39834

Link:

https://www.unpac.me/results/218ed85c-4c6c-48aa-bc24-fe9d95c98139/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1065589a9340/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1065589a9340762824a0d03fff314f61e65083bf59cbc457e7ebb4986d871611

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	LokiBot Create hunting rule
Author:	kevoreilly
Description:	LokiBot Payload

Rule name:	malware_Lokibot_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	MAL_Lokibot_Stealer Create hunting rule
Description:	Detects Lokibot Stealer Variants

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

exe 1065589a9340762824a0d03fff314f61e65083bf59cbc457e7ebb4986d871611

(this sample)

Dropped by

loki

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/284080/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample