MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ce96413ec00dfb12023381264f92287f425fbc8af4357f370f8f9ab9a030dbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 16

Intelligence 16 IOCs YARA 2 File information Comments

SHA256 hash:	2ce96413ec00dfb12023381264f92287f425fbc8af4357f370f8f9ab9a030dbc
SHA3-384 hash:	725649fa4833e83d5c942a23e9a63df8d76da719881ad0f657a8d365d7d9bb0b88d428f3bb3b55c8ea65e0bae3e1d309
SHA1 hash:	8fa55e0e8471fe4652d1b57b30f5d209cbe0b025
MD5 hash:	9bfe16fe703e38f4014d6e1da6f51830
humanhash:	december-bakerloo-oxygen-west
File name:	Shipment Document BL,INV and packing list.jpg.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	685'056 bytes
First seen:	2023-07-26 05:06:19 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'473 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:mvvJRBusyWerdU5dH2AHVv/itX7bujP+1TOGcEh2tbNeUjMV5F:CFuVoH2A1v/CXw+JOGj2bNe8M
Threatray	4'235 similar samples on MalwareBazaar
TLSH	T1C9E4022437B8AF52E2AC7BF552A061140371D9596837D38C8EF120D61E63F90AB92FD7
TrID	69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4505/5/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter	cocaman
Tags:	DHL exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

301

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Shipment Document BL,INV and packing list.jpg.exe

Verdict:

Malicious activity

Analysis date:

2023-07-26 05:08:07 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/84c80af6-f9ef-4166-900d-c0e980df7d2c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

LokiBot

Link:

https://www.capesandbox.com/analysis/433335/

Detection(s):

SecuriteInfo.com.IL.Trojan.MSILMamut.11806.4638.9518.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Сreating synchronization primitives

Reading critical registry keys

Changing a file

Enabling the 'hidden' option for analyzed file

Stealing user critical data

Moving of the original file

Sending an HTTP POST request to an infection source

Gathering data

Verdict:

Malicious

Labled as:

IL:Trojan.MSILMamut

Link:

https://www.hybrid-analysis.com/sample/2ce96413ec00dfb12023381264f92287f425fbc8af4357f370f8f9ab9a030dbc

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/583b0b4b-74d0-4e82-a5f6-f7c577d84792

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1279808

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/2ce96413ec00dfb12023381264f92287f425fbc8af4357f370f8f9ab9a030dbc/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-07-26 05:06:33 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ftuwie7madp3cibdhajgj6jcq72cl66iv5bvp43q7d42xgqdbw6a._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/230726-frzjdshc58/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://138.68.56.139/?p=13459621
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

c5a8d3916fb566967e2813fbd76ee4716fe136c6aa5848fe88413d7a3cef5cc2

MD5 hash:

3808c393da75095d18b728e26a03dc7f

SHA1 hash:

df711e6ce0115742800e69c0c527fb376dfd368c

Link:

https://www.unpac.me/results/68108312-b176-4f9a-98bc-5d29c74e8f69/

SH256 hash:

3f68cc843eb3b2a764dc02355e2e3f97dce8f1164d6f18a4f77e850410dfc137

MD5 hash:

60126f10641986bbcefca9ed6159994b

SHA1 hash:

df584155d49b10805f1f0d81a758e98b23990815

Link:

https://www.unpac.me/results/68108312-b176-4f9a-98bc-5d29c74e8f69/

SH256 hash:

e6f6d4537b5a06dcaa639efb0f59ad138130ef4c513244de3546a5738c0ebed3

MD5 hash:

04c1c72fcdab1c3639a9bedb97400004

SHA1 hash:

0e02ae80df4243f81292cbfbed7037f171aaf544

Link:

https://www.unpac.me/results/68108312-b176-4f9a-98bc-5d29c74e8f69/

SH256 hash:

bc5b99f46d73cf7d1c7b0aeb705169490c4237c64d586ffcc4288db8b40173ea

MD5 hash:

38c8186f8c1d1ef5b62dd5ee4e11eed2

SHA1 hash:

0891a3b4d118ca45d8da842c62a11fdcfcb66d24

Detections:

lokibot

win_lokipws_auto

win_lokipws_g0

Link:

https://www.unpac.me/results/68108312-b176-4f9a-98bc-5d29c74e8f69/

Parent samples :

2e0d0762433ff21184bb4e8330db8fa104958537fad81fb39d8e3e7d849ee9f8
2ce96413ec00dfb12023381264f92287f425fbc8af4357f370f8f9ab9a030dbc

SH256 hash:

2ce96413ec00dfb12023381264f92287f425fbc8af4357f370f8f9ab9a030dbc

MD5 hash:

9bfe16fe703e38f4014d6e1da6f51830

SHA1 hash:

8fa55e0e8471fe4652d1b57b30f5d209cbe0b025

Link:

https://www.unpac.me/results/68108312-b176-4f9a-98bc-5d29c74e8f69/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2ce96413ec00/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/2ce96413ec00dfb12023381264f92287f425fbc8af4357f370f8f9ab9a030dbc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.