MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2327df8853c7f67ab43cda8c3f0494f148f74682aecaa685fd932bcc2b4df5a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2327df8853c7f67ab43cda8c3f0494f148f74682aecaa685fd932bcc2b4df5a1
SHA3-384 hash: 6d3c19e3de7bf9721b9bb498bf0ec1fb5c23ece4d4d9c56d22e538c71739ed205d735629636e6dff3d9371d5c8d57f2e
SHA1 hash: f3aa3d1a2cd8478e9900f8e40568a073ecccf50b
MD5 hash: 0bedced4f80f29a3a4eacf08a57a7d1a
humanhash: football-magnesium-eighteen-robin
File name:Shipping Document.jpg.exe
Download: download sample
Signature Loki
Create hunting rule
File size:548'352 bytes
First seen:2021-12-01 14:11:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'845 x AgentTesla, 19'775 x Formbook, 12'298 x SnakeKeylogger)
ssdeep 12288:iOjwBJ1/bh3pVEwpxF52leiZ+++E0m/saoJk+IBiGMBJ1:iXBJthTEmPs8s++7Sk+IeBJ
Threatray 5'681 similar samples on MalwareBazaar
TLSH T1C1C4F12477F9AF65C4B84BFC416A26148BF8795BF013E79A0EC531CB2AB2F429611D07
File icon (PE):PE icon
dhash icon c668f8cce0d0f0f0 (7 x AgentTesla, 4 x Loki, 3 x Formbook)
Reporter cocaman
Tags:DHL exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Shipping Document.jpg.exe
Verdict:
Malicious activity
Analysis date:
2021-12-01 14:21:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/27d0c0e6-707d-4b31-bbf3-0a3c41f2e733

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/210333/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Creating a file
Reading critical registry keys
Changing a file
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for analyzed file
Stealing user critical data
Moving of the original file
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm obfuscated packed
Link:
https://www.filescan.io/uploads/61a782b786bf67e7121d6fc8/reports/5491e989-9927-457a-8024-0b9d630cecb4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/05fef065-86c9-4efb-8ccf-9d3720b723e1
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/899469
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicius Add Task From User AppData Temp
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 531948 Sample: Shipping Document.jpg.exe Startdate: 01/12/2021 Architecture: WINDOWS Score: 100 32 roboticsengineeringtech.xyz 2->32 40 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->40 42 Multi AV Scanner detection for domain / URL 2->42 44 Found malware configuration 2->44 46 18 other signatures 2->46 8 Shipping Document.jpg.exe 7 2->8         started        signatures3 process4 file5 26 C:\Users\user\AppData\...\BwvLWCLsGodg.exe, PE32 8->26 dropped 28 C:\Users\user\AppData\Local\...\tmpE8A8.tmp, XML 8->28 dropped 30 C:\Users\...\Shipping Document.jpg.exe.log, ASCII 8->30 dropped 48 Adds a directory exclusion to Windows Defender 8->48 50 Injects a PE file into a foreign processes 8->50 12 Shipping Document.jpg.exe 54 8->12         started        16 powershell.exe 25 8->16         started        18 schtasks.exe 1 8->18         started        20 Shipping Document.jpg.exe 8->20         started        signatures6 process7 dnsIp8 34 104.21.52.46, 49760, 49767, 49772 CLOUDFLARENETUS United States 12->34 36 roboticsengineeringtech.xyz 172.67.195.96, 49759, 49761, 49762 CLOUDFLARENETUS United States 12->36 38 192.168.2.1 unknown unknown 12->38 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->52 54 Tries to steal Mail credentials (via file / registry access) 12->54 56 Tries to harvest and steal ftp login credentials 12->56 58 Tries to harvest and steal browser information (history, passwords, etc) 12->58 22 conhost.exe 16->22         started        24 conhost.exe 18->24         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2327df8853c7f67ab43cda8c3f0494f148f74682aecaa685fd932bcc2b4df5a1/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-12-01 09:26:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
20
AV detection:
17 of 45 (37.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=emt57ccty73hvnb43kgd6beu6feporucv3fknbp5smv4yk2n6wqq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
1df79ab2f458506485c16e48f42bc6aeb291e9b60f4677c1e9bf0b6646bb97bb
Loki
261f71400e54ce858290ed5f854270e28d9bd830a4e89525d4606a3b2ab32c64
Loki
4d1e6b617be93859a64b96bcf336cff274c4a0abba9abadfc1d8144101672645
Loki
55ca0fb88197e9dcc1cd2e7a23b95e1def8db9fe3e15e0532f011e172567619c
Loki
8173d9ed42e73e08740d986c47b2e283d0d74b8186ed7d7df59ae4af90fd1150
Loki
840fbba420882a6fd6f1e35582b2aa0cdbaaf04f56ee8dfab22980e6736096b4
Loki
afd221d1367bd807c20da212cc02b1cd7eb71677cd2c2cbbb999bae40c4b9554
Loki
ea002c36dfe650365e92d0921b6cfc8586c97b371b134f1e32bac834561b3ef6
Loki
f2e9cc84d53231470b1fa5491464a00cb7562000a56e0ce8264a61783e44ed75
Loki
+ 5'671 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/211201-rhvpmafgf9/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://roboticsengineeringtech.xyz/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
1c92d6ae15396357851ac60dfadb6282764be539908357592898ca890a5e2fea
MD5 hash:
4cd5b3d39406435dfba053f9dfd58e94
SHA1 hash:
78b5c89260ff38ac800b8dd81e58a2a9825c7db7
Link:
https://www.unpac.me/results/8f616f85-2de1-444e-ba94-dc9adf772aee/
SH256 hash:
b1171c0b6e400356f32c55c92ba34ce2c02469d0e4e12d116be87dbb234a2e4c
MD5 hash:
c48b3b87a9c63b3df10462c74b8e95c1
SHA1 hash:
568c1b8ec2dad126affccde78a5da58054f5bedb
Link:
https://www.unpac.me/results/8f616f85-2de1-444e-ba94-dc9adf772aee/
SH256 hash:
2327df8853c7f67ab43cda8c3f0494f148f74682aecaa685fd932bcc2b4df5a1
MD5 hash:
0bedced4f80f29a3a4eacf08a57a7d1a
SHA1 hash:
f3aa3d1a2cd8478e9900f8e40568a073ecccf50b
Link:
https://www.unpac.me/results/8f616f85-2de1-444e-ba94-dc9adf772aee/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/2327df8853c7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2327df8853c7f67ab43cda8c3f0494f148f74682aecaa685fd932bcc2b4df5a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

ace 65a8197891e366a49f8577460a9aaa89ca583cfbec7aac0847d9ccbf75842b1a

Loki

Executable exe 2327df8853c7f67ab43cda8c3f0494f148f74682aecaa685fd932bcc2b4df5a1

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 65a8197891e366a49f8577460a9aaa89ca583cfbec7aac0847d9ccbf75842b1a
Cape
Cape
https://www.capesandbox.com/analysis/210333/

Comments