MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12758eea50a5f2637e5588c99cfe1ad7408b5214d952ef41cf186e0dfcb56dd0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12758eea50a5f2637e5588c99cfe1ad7408b5214d952ef41cf186e0dfcb56dd0
SHA3-384 hash: 3b43f05acf45045c59b785c4182cbb0ceb836d74118c2a4eb3847e040a0d9b2d805f3527c3f15b16a89fd8958721270f
SHA1 hash: b5cc7bdf0632240ab74326b668cbd701c59cf277
MD5 hash: 30e97352af5c2d4dc09a085d7f8e210f
humanhash: island-sierra-oscar-equal
File name:APPOINTMENT LETTER.exe
Download: download sample
Signature Loki
Create hunting rule
File size:2'215'424 bytes
First seen:2021-05-04 05:25:46 UTC
Last seen:2021-05-04 06:01:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:+mlJCQ79J3ZE1Xc5SwWOqG9Ay+McUHPBDmIw:+mlJCm7au45gv5ced
Threatray 2 similar samples on MalwareBazaar
TLSH 99A5295163A86E45E93E57B48731441847F6FC17DB72DB9EA884B0891FB3BC08F1A722
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://manvim.co/fb18/fre.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://manvim.co/fb18/fre.php https://threatfox.abuse.ch/ioc/28641/

Intelligence

File Origin
# of uploads :
2
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/149677/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.624-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/709254
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/12758eea50a5f2637e5588c99cfe1ad7408b5214d952ef41cf186e0dfcb56dd0/
Threat name:
Win32.Trojan.Sonbokli
Create hunting rule
Status:
Malicious
First seen:
2021-05-04 02:44:40 UTC
AV detection:
3 of 47 (6.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cj2y52squxzgg7svrdezz7q225aiwuqu3fjo6qopdbxa37fvnxia._file
Verdict:
unknown
Similar samples:
4b6ee615bf81f53ae678c3430249da8578e2fd2d2026a36ec3993cf8fbf8f70d
Loki
910f9987b35db8d13a06bb8feae8274601bb8afcdca3afcfed64ca8a66f498a4
Loki
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210504-ftllap12mj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://manvim.co/fb18/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
bdf79e57b5574f9bafb56f6d0592f5ee429df7eb0ad536fbdb4f2956aae36f87
MD5 hash:
826b29e2a141b055a5491c9d7dc6eea7
SHA1 hash:
af4201362b8603bf7e4b6e2ead1cfb610dd7c0a9
Link:
https://www.unpac.me/results/aa659f85-a6a4-461b-8199-5dea737303e6/
SH256 hash:
12758eea50a5f2637e5588c99cfe1ad7408b5214d952ef41cf186e0dfcb56dd0
MD5 hash:
30e97352af5c2d4dc09a085d7f8e210f
SHA1 hash:
b5cc7bdf0632240ab74326b668cbd701c59cf277
Link:
https://www.unpac.me/results/aa659f85-a6a4-461b-8199-5dea737303e6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.91
Link:
https://yomi.yoroi.company/submissions/12758eea50a5f2637e5588c99cfe1ad7408b5214d952ef41cf186e0dfcb56dd0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/149677/

Comments