MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28766d53e02141d8332cdb160ebbc4bee6df26596d0c041e15aae650d6613d32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 18


Intelligence 18 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28766d53e02141d8332cdb160ebbc4bee6df26596d0c041e15aae650d6613d32
SHA3-384 hash: 2ea2060ce09a14496c179b75c507d08036c328e8564092b152b486edc3bb2847b43af7c2dae9c6878538042406f63362
SHA1 hash: 4230742e046551ddc3145baf6ef5dcf99ba394f2
MD5 hash: 2922c109e30c924b0bc979434cc36f52
humanhash: east-butter-eleven-pluto
File name:C57B86BE5A9FA166A946D78D8B63D9817FF3E14DF83ABD88B654BD66167696DE.exe
Download: download sample
Signature Loki
Create hunting rule
File size:276'480 bytes
First seen:2024-07-24 21:17:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e22fde80595c4bea0880fd6845018d6a (7 x RedLineStealer, 6 x Loki, 6 x Worm.Ramnit)
ssdeep 6144:E917J2Wor8Z4gPjdq5Q1a5Q75ybFvjyTLtnoa:EHTor8Z4gJGQp75qRy
TLSH T13444AD00BB90D035F4B752F4487A93ACB53E7AA15B21A0CF63E51AEE56356E0EC3135B
TrID 29.5% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
21.3% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
16.0% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
8.4% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
6.7% (.SCR) Windows screen saver (13097/50/3)
File icon (PE):PE icon
dhash icon badacabecee6baa6 (95 x Stop, 87 x RedLineStealer, 62 x Smoke Loader)
Reporter Anonymous
Tags:exe Loki


Avatar
Anonymous
this malware sample is very nasty!

Intelligence

File Origin
# of uploads :
1
# of downloads :
362
Origin country :
CN CN
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
28766d53e02141d8332cdb160ebbc4bee6df26596d0c041e15aae650d6613d32.exe
Verdict:
Malicious activity
Analysis date:
2024-07-25 17:54:52 UTC
Tags:
bdaejec lokibot stealer trojan
Link:
https://app.any.run/tasks/8a15b711-5173-453e-98db-974f36a58b0c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Virus.Wapomi-9802127-0
Create hunting rule

Win.Dropper.Generickdz-9939781-0
Create hunting rule

Win.Trojan.Generickdz-9950759-0
Create hunting rule

Win.Trojan.Generickdz-9951389-0
Create hunting rule

Win.Packed.Crypterx-9954995-0
Create hunting rule

Win.Malware.Wapomi-10020301-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66a16f8dcb3d02fa0e4960b1
Tags:
Execution Generic Network Static Stealth
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a process from a recently created file
Changing an executable file
Creating a window
Sending an HTTP GET request to an infection source
Сreating synchronization primitives
Reading critical registry keys
Changing a file
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for analyzed file
Modifying an executable file
Query of malicious DNS domain
Connection attempt to an infection source
Stealing user critical data
Moving of the original file
Infecting executable files
Sending an HTTP POST request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint lolbin microsoft_visual_cc packed shell32
Link:
https://www.filescan.io/uploads/66a16f8b5568402317154f77/reports/f83748a4-2ffb-4e33-8af7-a86e0837119d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/94f57582-7c01-42b7-91df-72f5ea6bce07
Result
Threat name:
Bdaejec, Lokibot
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1480780
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Infects executable files (exe, dll, sys, html)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
PE file contains section with special chars
PE file has a writeable .text section
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses known network protocols on non-standard ports
Yara detected aPLib compressed binary
Yara detected Bdaejec
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1480780 Sample: C57B86BE5A9FA166A946D78D8B6... Startdate: 25/07/2024 Architecture: WINDOWS Score: 100 28 ddos.dnsnb8.net 2->28 34 Found malware configuration 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 Antivirus detection for URL or domain 2->38 40 12 other signatures 2->40 8 C57B86BE5A9FA166A946D78D8B63D9817FF3E14DF83ABD88B654BD66167696DE.exe 58 2->8         started        signatures3 process4 dnsIp5 30 164.90.194.235, 49705, 49706, 49707 DIGITALOCEAN-ASNUS United States 8->30 20 C:\Users\user\AppData\Local\Temp\nyMqnz.exe, PE32 8->20 dropped 42 Detected unpacking (changes PE section rights) 8->42 44 Detected unpacking (overwrites its own PE header) 8->44 46 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 8->46 48 4 other signatures 8->48 13 nyMqnz.exe 18 8->13         started        file6 signatures7 process8 dnsIp9 32 ddos.dnsnb8.net 44.221.84.105, 49704, 49708, 49710 AMAZON-AESUS United States 13->32 22 C:\Program Files\7-Zip\Uninstall.exe, PE32 13->22 dropped 24 C:\Program Files (x86)\AutoIt3\...\SciTE.exe, PE32 13->24 dropped 26 C:\Program Files (x86)\AutoIt3\...\MyProg.exe, MS-DOS 13->26 dropped 50 Antivirus detection for dropped file 13->50 52 Detected unpacking (changes PE section rights) 13->52 54 Machine Learning detection for dropped file 13->54 56 Infects executable files (exe, dll, sys, html) 13->56 18 WerFault.exe 19 16 13->18         started        file10 signatures11 process12
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/28766d53e02141d8332cdb160ebbc4bee6df26596d0c041e15aae650d6613d32
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/28766d53e02141d8332cdb160ebbc4bee6df26596d0c041e15aae650d6613d32/
Threat name:
Win32.Virus.Jadtre
Create hunting rule
Status:
Malicious
First seen:
2024-07-24 21:18:05 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
24 of 24 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fb3g2u7aefa5qmzm3mla5o6ex3tn6jsznugaihqvvltfbvtbhuza._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot aspackv2 collection credential_access discovery spyware stealer trojan
Link:
https://tria.ge/reports/240724-z5k3psxeqp/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Accesses Microsoft Outlook profiles
ASPack v2.12-2.42
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Credentials from Password Stores: Credentials from Web Browsers
Lokibot
Malware Config
C2 Extraction:
http://164.90.194.235/?id=22044231991792986
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1fb82c0a-f7d7-414e-94dc-7855893d4d14
Unpacked files
SH256 hash:
19a17b6798dc66c9545b6b9589a5a03a5a49118f77a622aa4464f688c9ed21bd
MD5 hash:
b14ea9885fb45c0357efdec4f772b0a9
SHA1 hash:
db790fee6515046d6a196a9cdf5292f9cd3dd681
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
Lokibot
Create hunting rule
SUSP_XORed_URL_In_EXE
Create hunting rule
STEALER_Lokibot
Create hunting rule
Link:
https://www.unpac.me/results/a09b5d25-1f1b-4723-ba0a-2945b3136ef9/
Parent samples :
50762a8f6247c667e01b4f2d2a1c067401d8e278fd37e73668c927349b9727fc
a4182d8f62fb365856798683af6277ad0c3b3a9d9788fe1e2cef07bb918197d6
51c4a9a807294ba857735727b3c3378db60c3bafad52d7cc80538c41ad27eecd
cb59cd4c7a4896aab48aa27530bb65363920e5da091eec1aa2bdb538f9ae1491
6fa3ca5bec61c6c9427b467ecefd895568f9d2db64097a2acb5d987228f97b0c
ce79401a906246017cec719b5a89b228c0589704f04f962de647bbd34e5e1b2d
5ee578d8eb6093a0d276d092a6e431f1a947c3aebf19887cdf1f10f0fdd58982
eec6a78a53f177c69c4ed582296a052aaca152c4fd46a1d3fe87d2b18e756b77
067ba1eef584f508f510de3878bd69532e1e41d898a33f90f9bb5d39b3b5785f
10a09655d773fb061a1972e273aa5801fa4d4ab586b91e146469c5981b5562b1
c57b86be5a9fa166a946d78d8b63d9817ff3e14df83abd88b654bd66167696de
edf3903c8a44afdd2c2ede31eccc3bb8c088f21cb933637a0e79592f0079c2c3
28766d53e02141d8332cdb160ebbc4bee6df26596d0c041e15aae650d6613d32
SH256 hash:
2e74da613d40528efcc992bd244ebf6234d81377186fa764197d8c8103064f11
MD5 hash:
17c2b10f38f25589a1987c9ea36509d5
SHA1 hash:
7b3d3c9c3aa75f04c82f0fed084345673332d7a7
Detections:
win_unidentified_045_auto
Create hunting rule
win_unidentified_045_g0
Create hunting rule
Link:
https://www.unpac.me/results/a09b5d25-1f1b-4723-ba0a-2945b3136ef9/
SH256 hash:
28766d53e02141d8332cdb160ebbc4bee6df26596d0c041e15aae650d6613d32
MD5 hash:
2922c109e30c924b0bc979434cc36f52
SHA1 hash:
4230742e046551ddc3145baf6ef5dcf99ba394f2
Link:
https://www.unpac.me/results/a09b5d25-1f1b-4723-ba0a-2945b3136ef9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/28766d53e02141d8332cdb160ebbc4bee6df26596d0c041e15aae650d6613d32

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Executable exe 28766d53e02141d8332cdb160ebbc4bee6df26596d0c041e15aae650d6613d32

(this sample)

  
Link
https://bbs.kafan.cn/forum-31-1.html
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::SetProcessShutdownParameters
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::FindNextVolumeW
KERNEL32.dll::FindNextVolumeMountPointA
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::FillConsoleOutputCharacterA
KERNEL32.dll::FillConsoleOutputCharacterW
KERNEL32.dll::FlushConsoleInputBuffer
KERNEL32.dll::WriteConsoleInputA
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::WriteConsoleOutputCharacterA
KERNEL32.dll::WriteConsoleA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileExW
KERNEL32.dll::CopyFileA
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::MoveFileWithProgressW
KERNEL32.dll::MoveFileA

Comments