MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 273e0f6bab25ebc17a3f52ac7998ae2e517e1d2e6b9c8a88ede814f521bf408d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments 1

SHA256 hash:	273e0f6bab25ebc17a3f52ac7998ae2e517e1d2e6b9c8a88ede814f521bf408d
SHA3-384 hash:	9944afe99ebe75106f085e456133299f68e5c14cf21b0b2866c2c3058b6eba8974ee843db053ddcdce892cc5c3c756e6
SHA1 hash:	a60a75166b9e9819bd2e9a8007ad01876282bcf3
MD5 hash:	ebd30cc26cf38d0bf84f36d9715af9fd
humanhash:	tango-ten-utah-quiet
File name:	ebd30cc26cf38d0bf84f36d9715af9fd
Download:	download sample
Signature	Loki Create hunting rule
File size:	476'672 bytes
First seen:	2021-11-01 10:56:06 UTC
Last seen:	2021-11-01 13:12:52 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	12288:b78H1+zbSTlrWjW7YuArzrGDcvcwDNggc+TRPyke:3zuT1WKarHGDc0ac8Pyke
Threatray	40 similar samples on MalwareBazaar
TLSH	T18AA49E66A27C9F43D83463FC84203148ABB06621BC97DB8DCFC127DD8A367B5AD61587
Reporter	zbetcheckin
Tags:	32 exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

PO#29688.xlsx

Verdict:

Malicious activity

Analysis date:

2021-11-01 09:17:21 UTC

Tags:

encrypted opendir exploit CVE-2017-11882 loader

Link:

https://app.any.run/tasks/49460c49-e470-43ae-9d21-2fb2dc42d07e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.Inject4.18180.12478.10097.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Creating a file in the %temp% directory

Delayed writing of the file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/617ffa59a9d585e6d53d4f19/reports/2735d62f-4e42-4e28-b507-386b4fcafd7c/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/37e4ed48-46c3-4bbf-aabc-d7faa3fe96e3

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/880338

Signature

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/273e0f6bab25ebc17a3f52ac7998ae2e517e1d2e6b9c8a88ede814f521bf408d/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-11-01 10:57:05 UTC

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/211101-m1rcpseecn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Unpacked files

SH256 hash:

0dd112b963c911753639dcfda4387b2c504eea8daed158f66f6d573ae3de558f

MD5 hash:

1378ffa5808625509bbccb3683b9cc49

SHA1 hash:

1b935ac117e7948c107062d285368e5b9afbd2d3

Link:

https://www.unpac.me/results/7ca13efa-5a0f-4e62-b23b-40e89af800b6/

SH256 hash:

baa3e2981023caed2aa00e2c9f8d3189ea07b68350331c3b836641142a34fc4d

MD5 hash:

fd907f5305f50b587ca7b6892b411187

SHA1 hash:

22c4fc952cd3a8f0ac338a55b258d51f79ae3d88

Detections:

win_lokipws_g0

win_lokipws_auto

Link:

https://www.unpac.me/results/7ca13efa-5a0f-4e62-b23b-40e89af800b6/

SH256 hash:

7ec7c47de5927351c7035f8657a2dd91c42fd6ed6e4da309e34b87ef0b0ba785

MD5 hash:

171a2669225911b41301096cd9dcf19f

SHA1 hash:

dc25f1f69faec5174e489a0d1a18cf14cf7fd1b5

Link:

https://www.unpac.me/results/7ca13efa-5a0f-4e62-b23b-40e89af800b6/

SH256 hash:

273e0f6bab25ebc17a3f52ac7998ae2e517e1d2e6b9c8a88ede814f521bf408d

MD5 hash:

ebd30cc26cf38d0bf84f36d9715af9fd

SHA1 hash:

a60a75166b9e9819bd2e9a8007ad01876282bcf3

Link:

https://www.unpac.me/results/7ca13efa-5a0f-4e62-b23b-40e89af800b6/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.68

Link:

https://yomi.yoroi.company/submissions/273e0f6bab25ebc17a3f52ac7998ae2e517e1d2e6b9c8a88ede814f521bf408d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe 273e0f6bab25ebc17a3f52ac7998ae2e517e1d2e6b9c8a88ede814f521bf408d

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1735348/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-11-01 10:56:07 UTC

url : hxxp://itisalllove.servepics.com/many/more/file.exe