MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 192e4319bd154cebbbf5354e1b04bc8fb53b9dc6bd48887d2ce1f4159bee5b4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 192e4319bd154cebbbf5354e1b04bc8fb53b9dc6bd48887d2ce1f4159bee5b4e
SHA3-384 hash: 74749766deb8bd44347cca9b5b727b2327de1ca75f4e1ff1c5b353861c67eebe21a6f7644740fe889050a1e681c42be6
SHA1 hash: 51dd7e5ff96e5d46e273ea091819ed219ac938c9
MD5 hash: 5f05951c46489b0fd89990d54a906f5e
humanhash: illinois-bluebird-stream-four
File name:PURCHASE ORDER.exe
Download: download sample
Signature Loki
Create hunting rule
File size:259'823 bytes
First seen:2021-11-11 12:44:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:rGiLLFZjeCXvHhGphIKjBwvoj1ljBBKW9fm3DnI6U:hZjjvHwp6KjBU4JB54nIR
Threatray 5'379 similar samples on MalwareBazaar
TLSH T12B44122767C042B3F29314350877EFF7D7B5819941FABA9307BCAD7A2EA34465E28121
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter malwarelabnet
Tags:exe Loki Lokibot

Intelligence

File Origin
# of uploads :
1
# of downloads :
363
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/204976/
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
60%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/618d1050a00afa9663a3fc26/reports/411c68eb-0d5c-43ed-8985-c306144c7d93/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fdc3f47f-fbcd-4eb1-8d4a-3514c255123a
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/887452
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Executable has a suspicious name (potential lure to open the executable)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/192e4319bd154cebbbf5354e1b04bc8fb53b9dc6bd48887d2ce1f4159bee5b4e/
Threat name:
Win32.Backdoor.Zapchast
Create hunting rule
Status:
Malicious
First seen:
2021-11-11 12:34:08 UTC
AV detection:
11 of 45 (24.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dexeggn5cvgoxo7vgvhbwbf4r62txhogxveiq7jm4h2blg7olnha._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
15b446aaa531cac9c5464d712493d14b892ef3cbf6a212b1f37a53c9f2015d2b
Loki
397d08a888f2174c57f1ffa6d26dbf903bb072e9dc1509ce9c119350e837eb65
Loki
3adcd6bfdb97a238c80d0cf8554fe4cabc22c50e03bd16985f8fcc02deb90f05
Loki
74498a0a179b34e0d1e4c278deb7563129cb30363094d50b3c4f579a6a967b62
Loki
7b12e253b0bf89ef0535a8dc539361954c67511bcdbc709060c0b1e6ed539cb6
Loki
895a3f8a366ed73ca1cab8ef49582ada6382880654ab28e95b2902cde46e3726
Loki
98cb7806db78b205e85ad35e926870dbf64302739fc87902a4a06d00b3987e01
Loki
f228ebe1b6d660825c71c76528486d30fe68858362b0bab96a203b4eba670c35
Loki
+ 5'369 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/211111-py3dasbce9/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Loads dropped DLL
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://63.250.40.204/~wpdemo/file.php?search=4985476
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
192e4319bd154cebbbf5354e1b04bc8fb53b9dc6bd48887d2ce1f4159bee5b4e
MD5 hash:
5f05951c46489b0fd89990d54a906f5e
SHA1 hash:
51dd7e5ff96e5d46e273ea091819ed219ac938c9
Link:
https://www.unpac.me/results/b0d66e93-e206-4d61-ba0b-7b49cd1731ef/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/192e4319bd15/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/192e4319bd154cebbbf5354e1b04bc8fb53b9dc6bd48887d2ce1f4159bee5b4e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/204976/

Comments