MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27842e6c3fded6e6779281ad99b9b305500ee29fc5350a2e7e86cbc1f97bbaa0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	27842e6c3fded6e6779281ad99b9b305500ee29fc5350a2e7e86cbc1f97bbaa0
SHA3-384 hash:	eb3d7cce12e8fcd8cffa12e48dd3fd78019098ab89e2bd7980cf250d7d4388bc5210b59b7c45ee68a368567f3138a6a0
SHA1 hash:	db73ac070bec3af576839b330945044a9650130f
MD5 hash:	d0672addc002b66d9713c209018e9426
humanhash:	december-hotel-winter-jig
File name:	20122136629549.LZH
Download:	download sample
Signature	Loki Create hunting rule
File size:	371'904 bytes
First seen:	2022-06-06 13:24:48 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:Itm7dXbXRdwacbGoRYVH7T7+P453uY7xlAbKJCV8DCuLHbEGKRqc0v1:IMNDk/dRaHX7+P453F1lAbFRX4c8
TLSH	T14984238F56F6532250B91078829A6C7DC5BD8A8EF1EB7084EC15BFDB2F8E106C885F15
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	Loki lzh rar

cocaman

Malicious email (T1566.001)
From: ""Dante Ocampo" <sourismini.sha@sourisminiinternational.com>" (likely spoofed)
Received: "from sourisminiinternational.com (unknown [185.222.57.182]) "
Date: "06 Jun 2022 12:56:31 +0200"
Subject: "ORDERS - NEW PHARMACY - 1376 - LIFE PHARMACY LLC-BR OF AUH 13 (AL BALOUSHI TOWER)"
Attachment: "20122136629549.LZH"

Intelligence

File Origin

# of uploads :

# of downloads :

289

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/27842e6c3fded6e6779281ad99b9b305500ee29fc5350a2e7e86cbc1f97bbaa0/

Threat name:

ByteCode-MSIL.Trojan.LokiBot

Status:

Malicious

First seen:

2022-06-06 00:39:33 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

21 of 41 (51.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=e6cc43b733lom54sqgwztontavia5yu7yu2qult6q3f4d6l3xkqa._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220606-qnysssgdg6/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Fake 404 Response

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://45.133.1.45/success/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://��Ќ��Й��Й��я��

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/27842e6c3fded6e6779281ad99b9b305500ee29fc5350a2e7e86cbc1f97bbaa0