MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2310c9985e7434fdac9fab92a88e8f916bb079761a4ae354888533610ef48944. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Maldoc score: 11


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2310c9985e7434fdac9fab92a88e8f916bb079761a4ae354888533610ef48944
SHA3-384 hash: a84bc22fc6c1b49f743db798d4c227f8e800e9c80dbe5619773f9853232256ef36ba178b02d3c90d94d87d9c3ddc0d1b
SHA1 hash: 7187dea0026c7fd7bd162c710d3dff5d8b7c0057
MD5 hash: c34b51719e5e3881c8c2af784ae7157f
humanhash: maine-delta-diet-item
File name:ORDER-45103.xls
Download: download sample
Signature Loki
Create hunting rule
File size:335'360 bytes
First seen:2020-11-17 08:33:18 UTC
Last seen:2021-02-12 19:34:44 UTC
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 6144:Xk3hOdsylKlgryzc4bNhZF+E+W2knm4BCV0zvoHabWXxRkaRpZmqJQvwUmUBO0qy:z4k00HabWhWapLQrm2dqZqzVLKncpGkX
TLSH CA6412E372800E0AD83D97BD5A2B57415231FCD2AFB3821EA796F7055B727C0895329B
Reporter ffforward
Tags:Loki Lokibot xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 11
Application name is unknown
Office document is in OLE format
Office document contains VBA Macros
OLE dump

MalwareBazaar was able to identify 10 sections in this file using oledump:

Section IDSection sizeSection name
1107 bytesCompObj
2248 bytesDocumentSummaryInformation
3176 bytesSummaryInformation
4325534 bytesWorkbook
5524 bytes_VBA_PROJECT_CUR/PROJECT
6137 bytes_VBA_PROJECT_CUR/PROJECTwm
71363 bytes_VBA_PROJECT_CUR/VBA/ThisWorkbook
87 bytes_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
9284 bytes_VBA_PROJECT_CUR/VBA/dir
10197 bytes_VBA_PROJECT_CUR/VBA/nqnmdrdrnnsioifiyzfrhuvlecbeluy
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecWorkbook_OpenRuns when the Excel Workbook is opened
IOCtuchbqygspcxlvaypgodExecutable file name
IOC0488.exeExecutable file name
SuspiciousShellMay run an executable file or a system command
SuspiciousvbNormalNoFocusMay run an executable file or a system command
SuspiciousLibMay run code from a DLL
SuspiciousURLDownloadToFileAMay download files from the Internet
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
2
# of downloads :
791
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Creating a file
Creating a process with a hidden window
Creating a file in the %temp% subdirectories
Running batch commands
Launching a process
Creating a file in the %AppData% directory
Launching a file downloaded from the Internet
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Sending an HTTP GET request to an infection source by exploiting the app vulnerability
Creating a process from a recently created file
Result
Verdict:
0
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/539182
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Creates an autostart registry key pointing to binary in C:\Windows
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Drops PE files to the user root directory
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Office process drops PE file
Sigma detected: Add file from suspicious location to autostart registry
Sigma detected: Executables Started in Suspicious Folder
Sigma detected: Execution in Non-Executable Folder
Sigma detected: MS Office Product Spawning Exe in User Dir
Sigma detected: Suspicious Program Location Process Starts
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 318691 Sample: ORDER-45103.xls Startdate: 17/11/2020 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->48 50 Multi AV Scanner detection for domain / URL 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 18 other signatures 2->54 8 EXCEL.EXE 57 24 2->8         started        13 pcalua.exe 1 2->13         started        15 pcalua.exe 1 2->15         started        process3 dnsIp4 44 sparepartiran.com 162.223.88.131, 49167, 80 COLOUPUS United States 8->44 40 C:\Users\user\AppData\...\SDJ-0488[1].exe, PE32 8->40 dropped 42 tuchbqygspcxlvaypg...ckeeskhbraogqmc.exe, PE32 8->42 dropped 86 Document exploit detected (creates forbidden files) 8->86 88 Document exploit detected (process start blacklist hit) 8->88 90 Document exploit detected (UrlDownloadToFile) 8->90 17 tuchbqygspcxlvaypgodvltgytmkfuckeeskhbraogqmc.exe 6 8->17         started        21 yihg.exe 3 13->21         started        file5 signatures6 process7 file8 34 C:\Users\user\AppData\Roaming\yihg.exe, PE32 17->34 dropped 36 C:\Users\user\AppData\Local\Temp\...\e.dll, PE32 17->36 dropped 56 Multi AV Scanner detection for dropped file 17->56 58 Machine Learning detection for dropped file 17->58 60 Tries to detect virtualization through RDTSC time measurements 17->60 23 yihg.exe 2 17->23         started        26 cmd.exe 17->26         started        38 C:\Users\user\AppData\...\AddInProcess32.exe, PE32 21->38 dropped 62 Writes to foreign memory regions 21->62 64 Allocates memory in foreign processes 21->64 66 Hides that the sample has been downloaded from the Internet (zone.identifier) 21->66 68 Injects a PE file into a foreign processes 21->68 28 AddInProcess32.exe 54 21->28         started        signatures9 process10 dnsIp11 70 Multi AV Scanner detection for dropped file 23->70 72 Machine Learning detection for dropped file 23->72 74 Tries to detect virtualization through RDTSC time measurements 23->74 76 Hides that the sample has been downloaded from the Internet (zone.identifier) 23->76 31 reg.exe 1 26->31         started        46 185.239.242.195, 49168, 49169, 49170 CLOUDIE-AS-APCloudieLimitedHK Moldova Republic of 28->46 78 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 28->78 80 Tries to steal Mail credentials (via file registry) 28->80 82 Tries to steal Mail credentials (via file access) 28->82 84 2 other signatures 28->84 signatures12 process13 signatures14 92 Creates an autostart registry key pointing to binary in C:\Windows 31->92
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2310c9985e7434fdac9fab92a88e8f916bb079761a4ae354888533610ef48944/
Threat name:
Script-Macro.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 05:41:49 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=emimtgc6oq2p3le7vojkrdupsfv3a6lwdjfogveiquzwcdxurfca._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot persistence spyware stealer trojan
Link:
https://tria.ge/reports/201117-hqj5wa6vqa/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Suspicious use of FindShellTrayWindow
Office loads VBA resources, possible macro or embedded object present
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Lokibot
Malware Config
C2 Extraction:
http://185.239.242.195/os/2b/cgi.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Excel file xls 2310c9985e7434fdac9fab92a88e8f916bb079761a4ae354888533610ef48944

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments