MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18f4fcd5e0df3982c65feadfe5ae92c26c798873c543028bfa76d939305c15f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 13

Intelligence 13 IOCs YARA 13 File information Comments

SHA256 hash:	18f4fcd5e0df3982c65feadfe5ae92c26c798873c543028bfa76d939305c15f4
SHA3-384 hash:	47d063901cf12c0f324fdf7efc44f2ee8f0afc02fed3584219f99fa1704cb35c8b41ea741f6ee3702a81137cc5e40d70
SHA1 hash:	1f59caf1550b96cee7634f63735b696ad07cb534
MD5 hash:	fe4bdee76dab7879ef9076f34ffa5470
humanhash:	failed-quiet-triple-triple
File name:	documents.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	706'048 bytes
First seen:	2022-06-06 19:35:11 UTC
Last seen:	2022-06-06 20:02:32 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'746 x AgentTesla, 19'628 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:Nfi/x2iNqDdpbSxdJGjySviE7u7I4O+hinx6ZzDOc7gmQ:di/x1QHbWEyNEdTWiIJDtg
Threatray	9'079 similar samples on MalwareBazaar
TLSH	T1C5E4BE85B3A99F32F13857F67510D41927B52E2F8AE0E2291CDAB0CE20B5B4305F5E5B
TrID	72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.4% (.EXE) Win64 Executable (generic) (10523/12/4) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	GovCERT_CH
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

425

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

lokibot

ID:

File name:

documents.exe

Verdict:

Malicious activity

Analysis date:

2022-06-06 19:40:11 UTC

Tags:

trojan lokibot stealer opendir

Link:

https://app.any.run/tasks/149ee249-0f49-4c09-b895-ef8a0abc77dd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

LokiBot

Link:

https://www.capesandbox.com/analysis/277133/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL

SecuriteInfo.com.Trojan.PackedNET.1364.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Launching a process

Creating a process with a hidden window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated packed replace.exe

Link:

https://www.filescan.io/uploads/629e572ea2b1fc9744d1fa30/reports/f20ac00a-a988-43dc-9224-98cf4891b8d2/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/cc856edf-df9c-4b03-bfd8-11a540069c9d

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1007640

Signature

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/18f4fcd5e0df3982c65feadfe5ae92c26c798873c543028bfa76d939305c15f4/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-06-06 18:14:48 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dd2pzvpa344yfrs75lp6llusyjwhtcdtyvbqfc72o3mtsmc4cx2a._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220606-ya81lsfdhl/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

https://blinkcard.co.vu/shin/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

9817859ba216d41fcdf6cba462f6fdb0c5ba479ab87d64ab3974b447bec29129

MD5 hash:

28f6585f1143d0b1bf8345dbcccbe217

SHA1 hash:

e6f3da2b05d20da8aa499cce2f238d55dc28b918

Detections:

win_lokipws_g0

win_lokipws_auto

lokibot

Link:

https://www.unpac.me/results/8d9fd043-3cb3-4993-991a-bc5be9b6670c/

Parent samples :

9d39d5e879fbf69a66c504a727dd38dc01d5555f324017888b8679c42a42ce03
f634dff5e11e123a3495dd867ff9300fb3eb22c0f2ca0b2f5d6e014b391bc9be
ca00e552544b5c316d1fe6739c87302a5444889c9a426ed558e26d0de82db4ff
d11d8fee0ee2b06c3290996b33a81bab51abf0281c27f2e9890fcb8377671040
23d09cab4649a3c8aa20f7cf4e3b671f5902e71e181c2c3a86bdaeb92e104c6f
a82a9113b739395948f36574b52ffe432c60778fbf2773796641198cd4ce505f
701c8a49d43fddc123ff023f82f058a7c7657689379d00d114354b03817e837f
a79d5d696650b4f3f5f764ca655ddd6817a38ff469d09090d98141e84963248c
4f7536dab8041ebc8e43c2334ce18be0b98228cb192a05297ab5b80ae6d147aa
18f4fcd5e0df3982c65feadfe5ae92c26c798873c543028bfa76d939305c15f4
8a6bffed79d6eb5c57b4eb47aba7789b3498b54845519a8db65bc1de3f37d982
4101090ade3774633d6ad416ca263c15a6890dd865f493d0f1ea3a2fcfddb2bf
752c92310cd1d5e610fe6fd659385f4d311fe96db287758e5e9df42ec3061ca0
763b9ddb8670835d34e5ecbd031c8077ad8c1e1572e43f558fa664a8d6b0c4d5
33a7a8caf94cce1c24fdd52abe6c8d7708d7d937811ba936495c6f103e2457f0

SH256 hash:

b16859bc0940e157ac2ad17d9f40bb70c81a30ca8fd041069dcc5e853f4ef879

MD5 hash:

85b5d3abaa9e7f70faeb76e4ca200524

SHA1 hash:

a87bcde9dac8cde827108a617832d5b63b908308

Link:

https://www.unpac.me/results/8d9fd043-3cb3-4993-991a-bc5be9b6670c/

SH256 hash:

8e88aaa9014d04b1ef25dbcda8ddd06017be33b89c185a0ef60e84ce07d4aa82

MD5 hash:

dbcd32a3fceab5491cf57ec1d665f4d2

SHA1 hash:

5805fb72ee86ee4420fd14790b29ee0651d35def

Link:

https://www.unpac.me/results/8d9fd043-3cb3-4993-991a-bc5be9b6670c/

SH256 hash:

8efffcc15cf4f9d54570125b205a169e983d3ff7499ff8c3d71b317d248a4ff3

MD5 hash:

0b3082d9a311ca53cf4690913890c686

SHA1 hash:

021c17ece31d60bb61934a3a2051662f55241b9e

Link:

https://www.unpac.me/results/8d9fd043-3cb3-4993-991a-bc5be9b6670c/

SH256 hash:

18f4fcd5e0df3982c65feadfe5ae92c26c798873c543028bfa76d939305c15f4

MD5 hash:

fe4bdee76dab7879ef9076f34ffa5470

SHA1 hash:

1f59caf1550b96cee7634f63735b696ad07cb534

Link:

https://www.unpac.me/results/8d9fd043-3cb3-4993-991a-bc5be9b6670c/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/18f4fcd5e0df/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/18f4fcd5e0df3982c65feadfe5ae92c26c798873c543028bfa76d939305c15f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	LokiBot Create hunting rule
Author:	kevoreilly
Description:	LokiBot Payload

Rule name:	malware_Lokibot_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	MAL_Lokibot_Stealer Create hunting rule
Description:	Detects Lokibot Stealer Variants

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

exe 18f4fcd5e0df3982c65feadfe5ae92c26c798873c543028bfa76d939305c15f4

(this sample)

Dropped by

loki

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/277133/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample