MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27fa1f24657b1710079922f92e16cdc7d1710257aabe93201bbf730b7ddea3a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27fa1f24657b1710079922f92e16cdc7d1710257aabe93201bbf730b7ddea3a9
SHA3-384 hash: b79f2b4885f9b4fcc79561c5278ac6f63af9a95dee0d032f28f99fae73901057612a524082985709fded6e49d01937db
SHA1 hash: 4eafb100f843014972cb54fa20ba1d978f65ffd1
MD5 hash: 7c9bdea1b19e08cdae31f39916a5fe47
humanhash: zulu-lemon-gee-lake
File name:7c9bdea1b19e08cdae31f39916a5fe47.exe
Download: download sample
Signature Loki
Create hunting rule
File size:993'280 bytes
First seen:2021-06-23 06:50:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:nOgxHX/ttVIszjGaFQgLXS9LyWwGZwI3H:jxHvttVLj9FhcLyWDZwI3
Threatray 3'393 similar samples on MalwareBazaar
TLSH 00259E3427A57F1DF57AE734A9A921D4D3F9F913E312EC9D7DE202CA0562E40CB60826
Reporter abuse_ch
Tags:exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7c9bdea1b19e08cdae31f39916a5fe47.exe
Verdict:
Malicious activity
Analysis date:
2021-06-23 06:57:49 UTC
Tags:
trojan lokibot stealer
Link:
https://app.any.run/tasks/0c8a1714-ee3d-46c4-beed-b0c56c142cb8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/167753/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader39.59262.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e0bf2567-57da-4309-b8a0-fb1e4f3020da
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/806424
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (creates a PE file in dynamic memory)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27fa1f24657b1710079922f92e16cdc7d1710257aabe93201bbf730b7ddea3a9/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-06-23 00:58:41 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e75b6jdfpmlrab4zel4s4fwny7ixcasxvk7jgia3x5zqw7o6uouq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
00969485768d60df4cd9c2055424b89dc7a241ab99a15c221f40dc601d4abf52
Loki
0eb2c1dc9f436530ce25a206a384f18325d8530d2152128cca6ae2316c2c3cfe
Loki
296828d37dd5732fa8bc85dd59c8032bdcbbf5aff62399ae72cabdd1989c475b
Loki
52be9c6c04342ea2394ea5585b2b29b1626527957577c970a76abc7476fce541
Loki
5d5c83ef1689244a96edcffb1c59f88a164b2f6c0881214e4338b82c61b28072
Loki
65309f9f8c2b26c74b9c77c1fc4cb88843021b7e2b6c4c8ed1c2ac743b200bed
Loki
8ab0599e3f141523358e5b60ef3cd9a2fb1fdbde52cb693e675a9004a25ff007
Loki
9b6212468424803dd746fc4b6c4f47a4c60f4462fae640b4f01ffa466308e7db
Loki
b975efada0ebff25099dd3da9986ad31cbd92c6a3547b9cd51345484ee0bfd12
Loki
def77e7d904351666d811474ea382080dde5326273039b91c1ee91113d5d7006
Loki
+ 3'383 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210623-dv9y2glvje/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://manvim.co/fc6/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
e412ac739e91c57810a380c18b4ab76b0563e9787b6560219f64e7612681ef9d
MD5 hash:
450991c864aea611301ef51c283f9ce0
SHA1 hash:
a6732484fc089cb2b7660c401945c929f34666a3
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/f7d9d95f-ef79-4e69-8a85-7520654a1dc7/
Parent samples :
b975efada0ebff25099dd3da9986ad31cbd92c6a3547b9cd51345484ee0bfd12
00969485768d60df4cd9c2055424b89dc7a241ab99a15c221f40dc601d4abf52
27fa1f24657b1710079922f92e16cdc7d1710257aabe93201bbf730b7ddea3a9
SH256 hash:
1b076b8db6ad77b3f0847e0640a494f611a942c9f75ff3cc2603811391c1711b
MD5 hash:
1d0321c0bb1d208951ad1d5b3906fc72
SHA1 hash:
b1e45728e108de82503e6836d5db67daf433b3e2
Link:
https://www.unpac.me/results/f7d9d95f-ef79-4e69-8a85-7520654a1dc7/
SH256 hash:
1c6e85d006fa39adb285c97f27bcd70fdc0513f94f3e84cd6e378d6cb821d32b
MD5 hash:
d29e402aa26d452c441b2577b27a7b96
SHA1 hash:
7637016e76a129dd81648ad424f22f62c5d7d7af
Link:
https://www.unpac.me/results/f7d9d95f-ef79-4e69-8a85-7520654a1dc7/
SH256 hash:
b975efada0ebff25099dd3da9986ad31cbd92c6a3547b9cd51345484ee0bfd12
MD5 hash:
aa645cb7dc6475a7b778aaeb12630a6f
SHA1 hash:
686d62b84d60c55d7543654547dd174f284aaf71
Link:
https://www.unpac.me/results/f7d9d95f-ef79-4e69-8a85-7520654a1dc7/
SH256 hash:
27fa1f24657b1710079922f92e16cdc7d1710257aabe93201bbf730b7ddea3a9
MD5 hash:
7c9bdea1b19e08cdae31f39916a5fe47
SHA1 hash:
4eafb100f843014972cb54fa20ba1d978f65ffd1
Link:
https://www.unpac.me/results/f7d9d95f-ef79-4e69-8a85-7520654a1dc7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/27fa1f24657b1710079922f92e16cdc7d1710257aabe93201bbf730b7ddea3a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe 27fa1f24657b1710079922f92e16cdc7d1710257aabe93201bbf730b7ddea3a9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1354045/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1354237/
Cape
Cape
https://www.capesandbox.com/analysis/167753/

Comments