MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26e8b299109afb86de1a69e3f533df3081b785e9b2c4725898e2af4e25341b95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26e8b299109afb86de1a69e3f533df3081b785e9b2c4725898e2af4e25341b95
SHA3-384 hash: 10bafc799aff2b8727f97ee784a06cf574b512d32ec5f198a2e03d11164357a6aac8a832bcb4ebbf73cdf6e807a95e37
SHA1 hash: 3fb298065a351239b70a7e6560ed894640d4e0a5
MD5 hash: 73e3360dcc18160386879521d6c3720a
humanhash: batman-island-apart-alpha
File name:Order Inquiry_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:250'875 bytes
First seen:2021-08-03 15:08:31 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:G3buy9R+16XMtzVOdx0fqh1EOTGwLneB9YdxwgFHyzxTJcb9I:GrrR98+difYEOT/nUYdZHwxTKb9I
TLSH T16C342357A0A01398C1A24EAF3185CC3BE88BD3572E12C92A7B74D35F6574C84F69645F
Reporter cocaman
Tags:gz Loki


Avatar
cocaman
Malicious email (T1566.001)
From: "Simo Trading Ltd <alabbas@simotrade.hu>" (likely spoofed)
Received: "from 213.yxnixm.club (hp0.213.yxnixm.club [138.68.132.6]) "
Date: "Tue, 03 Aug 2021 11:05:02 +0200"
Subject: "ORDER INQUIRY & OUR COMPANY OVERVIEW"
Attachment: "Order Inquiry_pdf.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Smdd-6956905-0
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/26e8b299109afb86de1a69e3f533df3081b785e9b2c4725898e2af4e25341b95/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-08-03 08:51:55 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
17 of 26 (65.38%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e3ulfgiqtl5ynxq2nhr7km67gca3pbpjwlchewey4kxu4jjudokq._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer suricata trojan
Link:
https://tria.ge/reports/210803-k93tfbjw3x/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://185.227.139.18/dsaicosaicasdi.php/rVXhi7NTm83H7
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/26e8b299109afb86de1a69e3f533df3081b785e9b2c4725898e2af4e25341b95

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 26e8b299109afb86de1a69e3f533df3081b785e9b2c4725898e2af4e25341b95

(this sample)

Loki

Executable exe b7780e3be29286fab7cf6ca17d1fc3f4acdde8329915d19e506719e553d81e7b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b7780e3be29286fab7cf6ca17d1fc3f4acdde8329915d19e506719e553d81e7b
  
Dropping
Loki

Comments