MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2af4c514474e77feb774b9c0faf1b17a41f92dbbef37c9d3f2d5778223f9a733. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Loki
Vendor detections: 14
| SHA256 hash: | 2af4c514474e77feb774b9c0faf1b17a41f92dbbef37c9d3f2d5778223f9a733 |
|---|---|
| SHA3-384 hash: | 52b739e753fb64ab229d83f32b6fa43ff4d0d00cee3fe7f588d72ba3c1d9520bcaaf4b506b7f9fdb9e7eb46bebd4e3f7 |
| SHA1 hash: | 5cfe30be0675a2aa50c460840fb4ebc6f8e7c1e4 |
| MD5 hash: | 0eebe460ee90755b159e1ecec0092b61 |
| humanhash: | mobile-lion-vermont-nineteen |
| File name: | DHL Receipt_AWB#2045829822.exe |
| Download: | download sample |
| Signature | Loki |
| File size: | 710'656 bytes |
| First seen: | 2022-07-18 07:08:11 UTC |
| Last seen: | 2022-07-18 07:47:11 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 12288:EekpNzB0WhNCWb2gb3IU35oQw28QnS0gWlnX+M4nCzcaFlSNS:EekpNl0esO9pa2TQsnX+JaQS |
| Threatray | 8'449 similar samples on MalwareBazaar |
| TLSH | T146E4120637EC1B06D8B5CBFD6436884057B9AA263271E39D8ED5A0DF55B2B818B40F1F |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Reporter |  abuse_ch |
| Tags: | DHL exe Loki |
Intelligence
File Origin
# of uploads :
2
# of downloads :
274
Origin country :
n/a
Vendor Threat Intelligence
Detection:
LokiBot
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Enabling the 'hidden' option for analyzed file
Moving of the original file
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Verdict:
Malicious
Result
Threat name:
Lokibot
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Generic Downloader
Yara detected Lokibot
Behaviour
Behavior Graph:
Detection:
lokibot
Threat name:
ByteCode-MSIL.Trojan.FormBook
Status:
Malicious
First seen:
2022-07-18 01:17:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
51
AV detection:
21 of 26 (80.77%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Similar samples:
+ 8'439 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Score:
10/10
Tags:
family:lokibot collection spyware stealer suricata trojan
Behaviour
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://198.187.30.47/p.php?id=10316882234268616
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807
MD5 hash:
db51fe170a9e5d6ec5429a2fbd9d0353
SHA1 hash:
e30a58125fc41322db6cf2ccb6a6d414ed379016
SH256 hash:
6593aa4078cab8936a7c689d95fbb5b526ec05cf96fcf8914827d93643c14ff9
MD5 hash:
33623feac5b14b0917bd9db7e3180c75
SHA1 hash:
6e5bab840a1873c00bc39c7909045fc75fffb47d
SH256 hash:
1bced31aaeda54366fcea3f04bdf8a1aa89f54c48660a8919c7b6fdfd23ed0a9
MD5 hash:
2e3d8682972eda68494caee2f811b692
SHA1 hash:
55d5852a851f14796027574e0713ddc59fe24369
SH256 hash:
8cab50128103091dc802fa352658fa5a6ef059d0478cc251a318778b097a1b6f
MD5 hash:
2a9e2a97f93ed4df7267e1ef6028ce4d
SHA1 hash:
28672c458c0a3f7c617e8bf45ec22cae980ac221
SH256 hash:
06535f6ed8de21369c67fd5c2f37688af55c21f57bcbf655b0f7ed128b2f1cf9
MD5 hash:
e36841343da08432d9dfca01728059a9
SHA1 hash:
16996ed3eb870bac3aaf793531c9baa0130f8143
Detections:
win_lokipws_g0
win_lokipws_auto
lokibot
Parent samples :
a4bb6e9c41c7d7f5b782355f7fb056f44fe66ad6ebd0d589b7941b8905e219d8
a3d46f7fe68a30115c4eae725622d4336e7ea6dde46b0104d113ddd55ff1e5a5
c86ba22021597e8876b4432a5ffb954f495e7f2a0a926af5f630e1f3e3e8acf5
3ed8d8e12f6a32642e80244929d185d80bb599ba317628a32d9cea8f46cb5f45
2af4c514474e77feb774b9c0faf1b17a41f92dbbef37c9d3f2d5778223f9a733
fa4058c30f37d1cdb72e5bbcc467ff8f9b584b090bfdf723ac1f04817980096a
a3d46f7fe68a30115c4eae725622d4336e7ea6dde46b0104d113ddd55ff1e5a5
c86ba22021597e8876b4432a5ffb954f495e7f2a0a926af5f630e1f3e3e8acf5
3ed8d8e12f6a32642e80244929d185d80bb599ba317628a32d9cea8f46cb5f45
2af4c514474e77feb774b9c0faf1b17a41f92dbbef37c9d3f2d5778223f9a733
fa4058c30f37d1cdb72e5bbcc467ff8f9b584b090bfdf723ac1f04817980096a
SH256 hash:
2af4c514474e77feb774b9c0faf1b17a41f92dbbef37c9d3f2d5778223f9a733
MD5 hash:
0eebe460ee90755b159e1ecec0092b61
SHA1 hash:
5cfe30be0675a2aa50c460840fb4ebc6f8e7c1e4
Malware family:
Lokibot
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.