MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15e84355978fd585af794a5aa1b61144a9197d1410219a4e129aca0ce953904d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	15e84355978fd585af794a5aa1b61144a9197d1410219a4e129aca0ce953904d
SHA3-384 hash:	85c3b3b100cd5a34fede0b42558ec088775ec14c7607c88b2637ea6ba4212e5ebe979863ea76fc2c438179bb24033aa9
SHA1 hash:	82137e8ed973f838e992c09cde4554900c93973b
MD5 hash:	e3e5da5bcf5aaf6e54271bef8c39b726
humanhash:	oklahoma-mars-eighteen-cold
File name:	e3e5da5bcf5aaf6e54271bef8c39b726.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	102'400 bytes
First seen:	2020-07-31 10:53:20 UTC
Last seen:	2020-07-31 12:44:30 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	3072:4a9B1wEX6I5U7uB4mq/oFSnM1cVX1vbU9BmX:4a9XzU7q4Jw/1eXVbU
Threatray	1'638 similar samples on MalwareBazaar
TLSH	D9A3016993888760C51B4B386F6326220B7DD5DA713177FF94C4C249EC7EBAE0A21F51
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Loki C2:
http://104.223.143.234/coconut/Panel/Panel/five/fre.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/36442/

Detection(s):

SecuriteInfo.com.Trojan.KeyLogger.25348.14182.2610.UNOFFICIAL

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/405919

Signature

.NET source code contains potential unpacker

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Sample uses process hollowing technique

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/15e84355978fd585af794a5aa1b61144a9197d1410219a4e129aca0ce953904d/

Threat name:

ByteCode-MSIL.Backdoor.Androm

Status:

Malicious

First seen:

2020-07-31 10:26:32 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=cxuegvmxr7kyll3zjjnkdnqrisurs7iucaqzutqstlfaz2ktsbgq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

spyware trojan stealer family:lokibot

Link:

https://tria.ge/reports/200731-hq682er766/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Uses the VBS compiler for execution

Lokibot

Malware Config

C2 Extraction:

http://104.223.143.234/coconut/Panel/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Gamarue

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/15e84355978fd585af794a5aa1b61144a9197d1410219a4e129aca0ce953904d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com