MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2288acc30c1e4430c546e42aec280f64d3f369fd83f71c269721d5136e1024a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2288acc30c1e4430c546e42aec280f64d3f369fd83f71c269721d5136e1024a5
SHA3-384 hash: 8fb74562e992e695d03cca6a22fb8e4eaf98354031dacbfb0ffdc2167546f9917f60f9fc5d81b40bede093e3542093d9
SHA1 hash: 2638c0acfbbcf9ef1ee655115afa884c6c7f8949
MD5 hash: 3d14bf28599bbe5174a86a80a37e4eed
humanhash: oklahoma-twelve-wyoming-mobile
File name:regasm(2).exe
Download: download sample
File size:400'522 bytes
First seen:2020-05-28 06:30:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 12288:VanYMCaDWSPSQyrO/LBNZMAaNcibQlPkBWEk4:CCpcLBNiKMQlWk4
Threatray 933 similar samples on MalwareBazaar
TLSH AB8412011140C8A7CE9641F085BEEFB66BFEFD1221895A4B7B803F5E7CA71426A1D3D6
Reporter oppimaniac

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 06:34:41 UTC
File Type:
PE (Exe)
Extracted files:
49
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
0e4c5cf2d1d60e4931c7af6021073006379935d688f5f55ad21fb29844d75a5a
0f24e222f76b19a0f1995c70e3711ab2b1c7e3f41c5e915796e767fce361e2e3
3c81bde8d413cadc04efa32c2754918d4a1a9c43a60181e7907cca8d31107826
581ccb74a37077703bcc314447ce7dfeec42832bad81225f1be6c214ca9bf51d
5c63c2887891a56e0465251c8112ce7a07fc70e782dbc2e80f45f670294d4285
5e23eed104a5bd67c8ae3abe1f3554abac8500bf9f916992df36246b06f14419
7ef7ff0660d406b237fd3253738d60a294c0273ca1436cf9ba87d5b2ea8d62d8
9f06ce1718cfa4e73366f82c9488b7a4aad4ddede7d7b3b51d44667607a3961c
b9d1b551c4bf7bca9c2b2006acaa9b7f4571fa16b469c1bab4d4e260d2a908ad
c2f42cfcfafad77546d57cbfde6a6f4c1c75d684a81304d1ec901285b1873bd3
+ 923 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/201109-l6mvf13c4a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Loads dropped DLL
Lokibot
Malware Config
C2 Extraction:
http://zangs.ga/ibiki/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 2288acc30c1e4430c546e42aec280f64d3f369fd83f71c269721d5136e1024a5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/370258/
  
Delivery method
Distributed via web download

Comments