MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15582393b01b6c64d16d7c573cec24dc00954c1faede0dc69777a1caa9757f7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 15

Intelligence 15 IOCs 1 YARA 3 File information Comments

SHA256 hash:	15582393b01b6c64d16d7c573cec24dc00954c1faede0dc69777a1caa9757f7d
SHA3-384 hash:	33a8f1e879974c9345d1c512b932ebfeedfd7fa19be6c5b061408d859ee0c61c4ee1591d1770aed3f8468db13f58e6e2
SHA1 hash:	c9ea3cdc9f537fe50088c07c239c69dea4456ddc
MD5 hash:	fed5b3d1972774645a11685a33140e28
humanhash:	hot-salami-louisiana-golf
File name:	New Order.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	551'313 bytes
First seen:	2024-10-22 06:41:16 UTC
Last seen:	2024-10-22 12:58:23 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	77b2e5e9b52fbef7638f64ab65f0c58c (12 x Formbook, 2 x Loki, 2 x AgentTesla)
ssdeep	12288:V9BvctM85t35JPNJj2WzoRLQYRYzmYcwbzbpFMQWaJZpQEB52oSwc3:VD0tM85tbNJjldeYiYpi+so1c3
Threatray	495 similar samples on MalwareBazaar
TLSH	T193C42301F188A4F9C5E58336DC47ABCA2BB7AC736B6B139333605E1F9E34935981B644
TrID	87.0% (.EXE) AutoIt3 compiled script executable (510622/80/67) 4.6% (.EXE) UPX compressed Win32 Executable (27066/9/6) 4.5% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 1.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 0.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
File icon (PE):
dhash icon	b150b26869b2d471 (468 x Formbook, 101 x RedLineStealer, 94 x AgentTesla)
Reporter	TeamDreier
Tags:	exe Loki

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://94.156.177.220/skipo/five/fre.php	https://threatfox.abuse.ch/ioc/1338553/

Intelligence

File Origin

# of uploads :

# of downloads :

414

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

New Order.exe

Verdict:

No threats detected

Analysis date:

2024-10-22 06:50:20 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e9e6be40-5e2f-46bc-9aa9-598b26ffdb46

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.27594.18136.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6717493c5a02f8393c72e51b

Tags:

Infosteal Buzus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Сreating synchronization primitives

Reading critical registry keys

Changing a file

Connection attempt

Creating a file in the %AppData% subdirectories

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/15582393b01b6c64d16d7c573cec24dc00954c1faede0dc69777a1caa9757f7d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Gathering data

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1539123

Signature

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Score:

76%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/15582393b01b6c64d16d7c573cec24dc00954c1faede0dc69777a1caa9757f7d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/15582393b01b6c64d16d7c573cec24dc00954c1faede0dc69777a1caa9757f7d/

Threat name:

Win32.Trojan.Autoitinject

Status:

Malicious

First seen:

2024-10-22 06:36:49 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cvmche5qdnwgjulnprltz3be3qajkta7v3pa3ruxo6q4vklvp56q._file

Verdict:

malicious

Label(s):

admintool_powerrun

unknown_loader_036

lokipasswordstealer(pws)

lokibot

Loki

15582393b01b6c64d16d7c573cec24dc00954c1faede0dc69777a1caa9757f7d

Loki

2fd281c29da243416deeee9780a5176031b9239a21fc9e40717662d97e2de598

Loki

879cdf7a49078364111d9efee1dbc31c8905e6d95f84d1041a60a088e4a280b0

Loki

9693e6a8bdaa7fa75e4a0215f8ba332db027c1ec11f7f4bf0a7fea17c73158ac

Loki

c9cf9ca824c529127e72e6eac74b9e1a7f78e8c0c5a906efbdf0b201fbee28cf

Loki

error

Loki

+ 485 additional samples on MalwareBazaar

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection discovery spyware stealer trojan upx

Link:

https://tria.ge/reports/241022-hgb2fssdjc/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

Accesses Microsoft Outlook profiles

Lokibot

Malware Config

C2 Extraction:

http://94.156.177.220/skipo/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/21e8d2f6-1219-4740-8724-41cdd31bf683

Unpacked files

SH256 hash:

132ba4ce6af88fa3690551febf72f6cfe526477bd12692fd31753aaec62ddd25

MD5 hash:

2af98d46b7a3d59d5fc8a97b4c5a0819

SHA1 hash:

25304c72be70f0322c0bd95f19ed5c6c1325c8b6

Detections:

lokibot

win_lokipws_auto

win_lokipws_g0

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Lokibot

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_GENInfoStealer

STEALER_Lokibot

Link:

https://www.unpac.me/results/a18b2af1-6829-4943-9f50-3039d2952426/

Parent samples :

15582393b01b6c64d16d7c573cec24dc00954c1faede0dc69777a1caa9757f7d
ac3f8b19b1d29525dddb1d48e4fcf7aec60ea5d93bcf9b874f9a61adde4ca13c

SH256 hash:

7a65b1bb7cd7c52b4c9b50375d6032b28e644350505ed666f7e169c71d8ef8e1

MD5 hash:

f35fbfa55d2419e3b34c37521d8df8f3

SHA1 hash:

8a7933e749fb8809699ce9194b551518dd65fbfe

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/a18b2af1-6829-4943-9f50-3039d2952426/

SH256 hash:

15582393b01b6c64d16d7c573cec24dc00954c1faede0dc69777a1caa9757f7d

MD5 hash:

fed5b3d1972774645a11685a33140e28

SHA1 hash:

c9ea3cdc9f537fe50088c07c239c69dea4456ddc

Link:

https://www.unpac.me/results/a18b2af1-6829-4943-9f50-3039d2952426/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/15582393b01b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/15582393b01b6c64d16d7c573cec24dc00954c1faede0dc69777a1caa9757f7d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPXv20MarkusLaszloReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

exe 15582393b01b6c64d16d7c573cec24dc00954c1faede0dc69777a1caa9757f7d

(this sample)

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::GetAce
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::timeGetTime
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample