MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13cd902db4c2d83cf33f2d2ab048f048126f7152a8e549fa31f5deeb4f2f0294. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13cd902db4c2d83cf33f2d2ab048f048126f7152a8e549fa31f5deeb4f2f0294
SHA3-384 hash: 102785186076610144a8082b170cd124a1239f3d2e79a05a2d7b75b5e3e5ba0e7d584de64f40f19d4282956eef81a4e1
SHA1 hash: 327fac8f44f2499bb94242791bd902d4f952adc8
MD5 hash: ecc32f34e2f7dd3142a79941b96d67f0
humanhash: washington-minnesota-nuts-april
File name:Doc0294585692_exe.exe
Download: download sample
Signature Loki
Create hunting rule
File size:377'344 bytes
First seen:2021-08-31 10:25:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ef471c0edf1877cd5a881a6a8bf647b9 (74 x Formbook, 33 x Loki, 29 x Loda)
ssdeep 6144:I4XrK9PX7Fp6Gh2wWRGl0EDDf1PisZQ5rAGQwg1QtP1f4paaYlsdcaMJEdbI0Pz9:XXe9PPlowWX0t6mOQwg1Qd15CcYk0Wet
Threatray 5'603 similar samples on MalwareBazaar
TLSH T1E984124548C4CCA6E71AB370D0B7CF9819757832CCD66B689754EA2EB870343B853A6F
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter GovCERT_CH
Tags:exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Doc0294585692_exe.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-31 10:32:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/827b6cb8-8284-4a42-bbd7-d12abf32732a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/184150/
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Sending a UDP request
Sending an HTTP GET request
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/63e87bd6-e88b-47a5-abce-fb82fbf6fbbf
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/842497
Signature
AutoIt script contains suspicious strings
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13cd902db4c2d83cf33f2d2ab048f048126f7152a8e549fa31f5deeb4f2f0294/
Threat name:
Win32.Trojan.Nymeria
Create hunting rule
Status:
Malicious
First seen:
2021-08-31 09:08:26 UTC
AV detection:
14 of 35 (40.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cpgzalnuylmdz4z7fuvlashqjajg64ksvdsut6rr6xpowtzpakka._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
238eed13e028fd7316db1306510ac4aba9159fad5095caf124893aef89f7cbb3
Loki
368a4dda90b399ae7d0ed91b5c8d1c9fd7cf90948cc6aaf808375381047896d5
Loki
750733fd4c90de2a0003bd6bbc410f61bfc88f1a2b70e6d8846a937b8372807a
Loki
8fde220d40458eceb049d049f5391e8b2ff8f60e49d64d1272602e97d000a742
Loki
a576c7f2ef99f454afdd5c93e22bfdcd0dcbe75c2bd909f37fed84226caaaa14
Loki
be76239da7234a7e43d56d819e0558d91bdc872aef6e08db9f612ca30355bb9b
Loki
be8ca19f6d30ff45310e64470f12b39dc6529b9921899f5671be5f9359ebf8aa
Loki
c59840f2a37cc434ef9e343de8cb199142f80d6dd77e7cfa0869972c76f2af34
Loki
e9e3490df4628c80e10723892c75cd036d340e4a09ca9527c5710e1b01e3847a
Loki
f8efdc806be878faaf8c96d42603f505f207f034106779d8a1a356d1eab253d6
Loki
+ 5'593 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan upx
Link:
https://tria.ge/reports/210831-fzy9qzq7na/
Behaviour
Modifies system certificate store
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://brokenislegion.gq/Office5/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
c881bde7a9e19b8861793607b3e792a37d87873d2f877840ef3e26ed6b358948
MD5 hash:
b96638cb547614bd14f7fea9e16ee3c8
SHA1 hash:
7ec087a1523b9462c57990ce4f5cd7f94b32d17c
Link:
https://www.unpac.me/results/2338b246-d743-478f-8998-e4edea5ce8cf/
SH256 hash:
13cd902db4c2d83cf33f2d2ab048f048126f7152a8e549fa31f5deeb4f2f0294
MD5 hash:
ecc32f34e2f7dd3142a79941b96d67f0
SHA1 hash:
327fac8f44f2499bb94242791bd902d4f952adc8
Link:
https://www.unpac.me/results/2338b246-d743-478f-8998-e4edea5ce8cf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.85
Link:
https://yomi.yoroi.company/submissions/13cd902db4c2d83cf33f2d2ab048f048126f7152a8e549fa31f5deeb4f2f0294

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Executable exe 13cd902db4c2d83cf33f2d2ab048f048126f7152a8e549fa31f5deeb4f2f0294

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/184150/

Comments