MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b730f958076e33d4a05e368760d7f28b04a4f745dbc67140247de91cd34942c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 11

Intelligence 11 IOCs YARA File information Comments

SHA256 hash:	1b730f958076e33d4a05e368760d7f28b04a4f745dbc67140247de91cd34942c
SHA3-384 hash:	7684e7cc8ae47e8950c0facf291e37131bec5f5fc3bf04bd3f57886f449a931f407c06aa8133a66dfe849448ba7128fe
SHA1 hash:	db834c9b5c71169addddc97fbab57c9b76ed9bb3
MD5 hash:	cc6ae23665c9c66e8a09888e0422f47c
humanhash:	ten-uranus-georgia-football
File name:	SEP, OCT & NOV SOA----WWP SHA.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	424'448 bytes
First seen:	2020-12-09 11:04:24 UTC
Last seen:	2020-12-09 13:02:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	553802f9e2099976b11882b89029573d (3 x AgentTesla, 1 x MassLogger, 1 x Loki)
ssdeep	6144:IGtae4uoN/jvF5wi+qry3if0UripBE+Cp:hahxTF5h+qWQ1iLFCp
Threatray	2'123 similar samples on MalwareBazaar
TLSH	C9948D0475D89030D2E6727A4FA4DA710369FC6E4D268E6B27E82D8F7AFC0C36615763
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Malspam distributing unidentified malware:

HELO: mail.it-lab.md
Sending IP: 79.140.160.80
From: Sophia Yang <steodorescu@cricova.md>
Subject: SEP, OCT & NOV SOA----WWP SHA
Attachment: SEP, OCT NOV SOA----WWP SHA.zip (contains "SEP, OCT & NOV SOA----WWP SHA.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

127

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SEP, OCT & NOV SOA----WWP SHA.exe

Verdict:

Malicious activity

Analysis date:

2020-12-09 11:26:33 UTC

Tags:

trojan lokibot

Link:

https://app.any.run/tasks/cc44e5e8-ac90-4299-9119-53e37152ef83

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/107459/

Detection(s):

SecuriteInfo.com.ArtemisCC6AE23665C9.31602.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Searching for the window

Creating a file in the %temp% subdirectories

Creating a file

Running batch commands

Modifying an executable file

Unauthorized injection to a recently created process

Reading critical registry keys

Launching a process

Changing a file

Replacing files

DNS request

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Stealing user critical data

Moving of the original file

Enabling autorun by creating a file

Result

Gathering data

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/558925

Signature

Found malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/1b730f958076e33d4a05e368760d7f28b04a4f745dbc67140247de91cd34942c/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dnzq7fmao3rt2sqf4nuhmdl7fcyeut3ulw6gofaci7pjdtjusqwa._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/201209-nknhgb9tks/

Behaviour

Creates scheduled task(s)

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Lokibot

Malware Config

C2 Extraction:

http://hanmails.net/elite/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php