MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 134b6a1a057a66cf663abb6311a7f795b425de6f0d19ead388d46cdc9a7c3d49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 134b6a1a057a66cf663abb6311a7f795b425de6f0d19ead388d46cdc9a7c3d49
SHA3-384 hash: 1759f1630a2d146901cef8708a9978244a702a7b0a6f34eaae0c918a3b677f8ea7dbc9a124f773ee1d95fe4c7b121d5e
SHA1 hash: 6ebbf886a45f37e370a7a809c35e40a3717e12e3
MD5 hash: 7dfbc46ade7f1ce8c940a4ebf01a682c
humanhash: zebra-friend-august-low
File name:QUOTATION.doc
Download: download sample
Signature Loki
Create hunting rule
File size:42'738 bytes
First seen:2020-10-23 14:56:36 UTC
Last seen:Never
File type:Word file doc
MIME type:application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep 768:nI5nQcozVqhjNmJDvgHmLPWXMS45ST8FFheOUI4N2S8gwhPoKAf/YaFGq:8QcozFVuMJ5ST8F7eOPM2az7
TLSH F51302B0C65DF176DD75D6B5949202E0E6AB80C2E316B5BE2C35BCCE434058BC3E68A8
Reporter abuse_ch
Tags:doc Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: nodo6.vpservidores.com
Sending IP: 185.176.9.117
From: Hangzhou Zhejiang Co., Ltd. <sales@technorexco.com>
Subject: RFQ # Q20182401 // ORDER_N ° 10014 // New_Suppliers_Ord er / [OCT-DEC]
Attachment: QUOTATION.doc

Loki payload URL:
http://opilacorp-bd.com/aa.exe

Loki C2:
http://mecharnise.ir/ife/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Doc.Downloader.Sagent-9770108-0
Create hunting rule

TwinWave.EvilDoc.StrConvMathKillingMeSoftly.20200914.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
DNS request
Sending an HTTP GET request
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Launching a service
Creating a file
Changing a file
Replacing files
Moving a file to the %AppData% subdirectory
Enabling the 'hidden' option for recently created files
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Connection attempt to an infection source
Bypassing of proactive protection methods using Windows Management Instrumentation (WMI)
Launching a process by exploiting the app vulnerability
Sending an HTTP POST request to an infection source
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/508231
Signature
.NET source code contains very large strings
Antivirus detection for dropped file
Compiles downloader code with a AMSI bypass
Creates processes via WMI
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Powershell drops PE file
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Suspicious Csc.exe Source File Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Very long command line found
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 303235 Sample: QUOTATION.doc Startdate: 23/10/2020 Architecture: WINDOWS Score: 100 47 mecharnise.ir 2->47 59 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->59 61 Multi AV Scanner detection for domain / URL 2->61 63 Found malware configuration 2->63 65 12 other signatures 2->65 8 powershell.exe 12 13 2->8         started        13 vlc.exe 12 2->13         started        15 WINWORD.EXE 303 40 2->15         started        signatures3 process4 dnsIp5 49 opilacorp-bd.com 67.43.12.122, 49167, 80 LIQUIDWEBUS United States 8->49 41 C:\Users\user\AppData\Roaming\rb6aef9.exe, PE32 8->41 dropped 43 C:\Users\user\AppData\...\zt3iqkn9.cmdline, UTF-8 8->43 dropped 45 C:\Users\user\AppData\Local\...\zt3iqkn9.0.cs, UTF-8 8->45 dropped 67 Compiles downloader code with a AMSI bypass 8->67 69 Powershell drops PE file 8->69 17 rb6aef9.exe 13 2 8->17         started        21 csc.exe 3 8->21         started        71 Injects a PE file into a foreign processes 13->71 23 vlc.exe 13->23         started        25 vlc.exe 13->25         started        file6 signatures7 process8 file9 37 C:\Users\user\AppData\Roaming\...\vlc.exe, PE32 17->37 dropped 53 Antivirus detection for dropped file 17->53 55 Tries to steal Mail credentials (via file registry) 17->55 57 Injects a PE file into a foreign processes 17->57 27 rb6aef9.exe 54 17->27         started        31 rb6aef9.exe 17->31         started        33 rb6aef9.exe 17->33         started        39 C:\Users\user\AppData\Local\...\zt3iqkn9.dll, PE32 21->39 dropped 35 cvtres.exe 21->35         started        signatures10 process11 dnsIp12 51 mecharnise.ir 104.237.252.41, 49169, 49170, 49171 DEDICATED-FIBER-COMMUNICATIONSUS United States 27->51 73 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 27->73 75 Tries to steal Mail credentials (via file access) 27->75 77 Tries to harvest and steal ftp login credentials 27->77 79 Tries to harvest and steal browser information (history, passwords, etc) 27->79 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/134b6a1a057a66cf663abb6311a7f795b425de6f0d19ead388d46cdc9a7c3d49/
Threat name:
Script-Macro.Trojan.Powload
Create hunting rule
Status:
Suspicious
First seen:
2020-10-23 14:34:47 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cnfwugqfpjtm6zr2xnrrdj7xsw2clxtpbum6vu4i2rwnzgt4hveq._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
persistence trojan spyware stealer family:lokibot
Link:
https://tria.ge/reports/201023-p6xks7k8za/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Enumerates system info in registry
Office loads VBA resources, possible macro or embedded object present
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run key to start application
Blacklisted process makes network request
Executes dropped EXE
Lokibot
Process spawned unexpected child process
Malware Config
C2 Extraction:
http://mecharnise.ir/ife/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/134b6a1a057a66cf663abb6311a7f795b425de6f0d19ead388d46cdc9a7c3d49

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Word file doc 134b6a1a057a66cf663abb6311a7f795b425de6f0d19ead388d46cdc9a7c3d49

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/740518/
  
Delivery method
Distributed via e-mail attachment

Comments