MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11480cf5c47c57040f917412a67d741bd7827ebe3c35779ab90199b4ab6280b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 11480cf5c47c57040f917412a67d741bd7827ebe3c35779ab90199b4ab6280b8
SHA3-384 hash: ac88540a9fdc9524de55f5bf072fca97e4719068f1a9495cf72544e8a4ffc3bfca262cd55022df3542ec2dd334a58770
SHA1 hash: 6d3633aa4b5a8ed02732c91c209e6d5ff7748071
MD5 hash: 274c9cbf94744f12b84ffaaced312872
humanhash: football-four-kilo-indigo
File name:proforma invoice_pdf________________________________________.BZ2
Download: download sample
Signature Loki
Create hunting rule
File size:291'079 bytes
First seen:2021-11-19 06:18:34 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:KgkVqKFM7da/HSIdzrUe/aCnWz7uakdaajjvdsfcjNnmzN7Sck6xw:1kLIda/H3zrUInQ6dgeskpmz8Gw
TLSH T18554239D28E334EBBA25437E3DAADB4E270399D5FC1458FD9935D0F3260292E3710A06
Reporter fabjer
Tags:bz2 Loki rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/619741da43e8f62b6699f276/reports/5ef5af0f-2980-45b4-b246-c5d5be2c0fea/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/11480cf5c47c57040f917412a67d741bd7827ebe3c35779ab90199b4ab6280b8/
Threat name:
ByteCode-MSIL.Infostealer.PrimaryPass
Create hunting rule
Status:
Malicious
First seen:
2021-11-19 01:48:17 UTC
AV detection:
9 of 44 (20.45%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cfeaz5oeprlqid4roqjkm7ludplye7v6hq2xpgvzagm3jk3cqc4a._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/211119-g274yscde7/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://secure01-redirect.net/gb5/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/11480cf5c47c57040f917412a67d741bd7827ebe3c35779ab90199b4ab6280b8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 11480cf5c47c57040f917412a67d741bd7827ebe3c35779ab90199b4ab6280b8

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments