MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1267a2b9b9ff99e4039372e8ee87b8d61ad0a4db0ee052564aee4ddccf2de9dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 17


Intelligence 17 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1267a2b9b9ff99e4039372e8ee87b8d61ad0a4db0ee052564aee4ddccf2de9dc
SHA3-384 hash: 320baa5408720aa933534ae2883e4d7dd451c4cd453c980cf0f16f15f927cf092c0f6d45161d0d1ef3267f7e2be1f380
SHA1 hash: a9c2fb723a074bb666a25d2cbb53b549014f27ca
MD5 hash: 07f532593a4c71ee76366396563a0f0b
humanhash: golf-august-hotel-twelve
File name:6iNmDKpdHgkpFRe.exe
Download: download sample
Signature Loki
Create hunting rule
File size:729'600 bytes
First seen:2023-06-18 16:51:40 UTC
Last seen:2023-06-19 15:44:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:gNUya2iNx5LbzIu9+r97hIySewQpnrfccbd+mObCzJ0/m63OCb3biaBWIgiY:Qa1j5LA97hIySsnYcMPCJ0l3OCbriaUI
Threatray 4'226 similar samples on MalwareBazaar
TLSH T139F4021066E0CF1AC5BF0BFA46501231873B6327F477D3060DC2B5FA2D627D2959AA8B
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter threatcat_ch
Tags:exe Loki

Intelligence

File Origin
# of uploads :
2
# of downloads :
325
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
6iNmDKpdHgkpFRe.exe
Verdict:
Malicious activity
Analysis date:
2023-06-18 16:52:49 UTC
Tags:
trojan lokibot
Link:
https://app.any.run/tasks/106eb907-a134-4051-822e-a6117331c597

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/400197/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Reading critical registry keys
Changing a file
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for analyzed file
Stealing user critical data
Moving of the original file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
floxif packed threat virus
Link:
https://www.filescan.io/uploads/648f363350830d5542c91449/reports/abfe224d-1cfe-496c-b332-909c3b7c9000/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/1267a2b9b9ff99e4039372e8ee87b8d61ad0a4db0ee052564aee4ddccf2de9dc
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5171733b-ab6d-4d02-9c2b-636e9402de28
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1256909
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1267a2b9b9ff99e4039372e8ee87b8d61ad0a4db0ee052564aee4ddccf2de9dc/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-06-16 03:21:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cjt2fonz76m6ia4toluo5b5y2ynnbjg3b3qfevsk5zg5ztzn5hoa._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
2a2dffa21a0803c3d837ab4df1844a649b97c09602879b1356569b61e1cd941c
Loki
444a16946d94ad161477432da668856aac2ff6b3e283bb944071812f5554f526
Loki
57ff6de510ccaa060efa53e2c9e1c1b8c3b132fa55289a8a7ecc321a5370043a
Loki
6bddaee0e17a72a52616cbc504f9ae60809ace82574414879689cc54a8fd81db
Loki
82f14f2328af922009bb022e324ef028b09b2570981c3d98b2a29957829a0b0a
Loki
c0cbe7aec17ef1a839c0344c4fe403684a7e90e89f105706c3d660cec8b2dc86
Loki
c41a86ef4cc333d1fa382b1aef023e72a4316dcbf7e0fd7b2670d2badfd17477
Loki
d4b09cfb630c5d4e123f5ea5076685911243496f62f489cf7a30479542096f35
Loki
e9104c6f82a1b8c52bb881161440b8b1a8e3bf358cd60672dbfc14a2bc12518d
Loki
+ 4'216 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/230618-vddgbsge52/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://161.35.102.56/~nikol/?p=27226656008
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
2a70f30314bf66f573bcf648412aace8e682c4fdcb6e0c965819e25642bcdea7
MD5 hash:
770cadf5070dac08f3a930384572c196
SHA1 hash:
ec5158f18bb7253ccf93a7ab6d5587e06affd67c
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
Link:
https://www.unpac.me/results/cd3b6ae9-8772-4926-9a07-3e4addeabb27/
Parent samples :
f37ca6c053e17063d8622f5016bf9547e95a06704c1226fd8d09e88f33a52957
c8a03bb2a34bef9c9adb1c61faa08c8b7d647c40be7b88029485e53335eb06b8
d4b09cfb630c5d4e123f5ea5076685911243496f62f489cf7a30479542096f35
b4cf7c6df77b6b4de0f687772bebf0add392ec60f709b68146e0d05eb104b077
1267a2b9b9ff99e4039372e8ee87b8d61ad0a4db0ee052564aee4ddccf2de9dc
4764e72be01dff161ce0a248e78c76787c80e739267b687b922f0e422852b7ba
38a9f881eb28d8f75c2c21a9cb4de15e472866346c747c480e8e6ec485982067
a4663c07ee4b03e78caa6564a47b82f2c78e3aa5c25ad5b30c6ffe781c6507a0
99b5659b8914b8687e303e0774ddd3a745cbf35368a8d2d698541ed643d1d554
fc1c2a3904caa654e1cbc35758a7f710d60f3dcef0c028eda87cd7e82489b472
e3a60c9d44679aa4a97d4a7d8c60e56dfc63243c126a8e92a92ba527dc4f5ee2
SH256 hash:
135a5aa693bba51f82c6682e040564769083b567f2c359214279879fdda0cdaf
MD5 hash:
4086f26574c3d5bdb89dc63a506c9772
SHA1 hash:
822128c26719d233b0b66b597733048fdf48b9a2
Link:
https://www.unpac.me/results/cd3b6ae9-8772-4926-9a07-3e4addeabb27/
SH256 hash:
d6d62867580dc9d28d4e47aa4b479916e7c1167f0700a56ae0da9d2d6f311308
MD5 hash:
6b9c9191a8e10ade40d8ab7eb5caeb92
SHA1 hash:
7fc053f77f020c18fea92701b171f049159a08d9
Link:
https://www.unpac.me/results/cd3b6ae9-8772-4926-9a07-3e4addeabb27/
SH256 hash:
b86193f0f5eeadf451f23596dffb4d015245311c67bc15244c2b1c81293d3679
MD5 hash:
be09d1a9fbdc7fe4ad47e49a0ccf2a0e
SHA1 hash:
3eea7d856de59fefd670110c2edda63c319a5a1b
Link:
https://www.unpac.me/results/cd3b6ae9-8772-4926-9a07-3e4addeabb27/
SH256 hash:
f92d10e3b0e6225a8f2c8ef7f67ff331c6a98ad910d06695b91802dfc746c5c7
MD5 hash:
044aa141d2c45adff0bf448f54f94a50
SHA1 hash:
1f1e962dccf8f71713189b9f6ea979be818d18c4
Link:
https://www.unpac.me/results/cd3b6ae9-8772-4926-9a07-3e4addeabb27/
SH256 hash:
1267a2b9b9ff99e4039372e8ee87b8d61ad0a4db0ee052564aee4ddccf2de9dc
MD5 hash:
07f532593a4c71ee76366396563a0f0b
SHA1 hash:
a9c2fb723a074bb666a25d2cbb53b549014f27ca
Link:
https://www.unpac.me/results/cd3b6ae9-8772-4926-9a07-3e4addeabb27/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1267a2b9b9ff99e4039372e8ee87b8d61ad0a4db0ee052564aee4ddccf2de9dc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:LokiBot
Create hunting rule
Author:kevoreilly
Description:LokiBot Payload
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:Windows_Trojan_Lokibot_0f421617
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Lokibot_1f885282
Create hunting rule
Author:Elastic Security
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Executable exe 1267a2b9b9ff99e4039372e8ee87b8d61ad0a4db0ee052564aee4ddccf2de9dc

(this sample)

  
Dropped by
loki
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/400197/

Comments