MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d80bcb044726fdc77e7cde1667921ec707af42ad318f172265d19817d893a62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d80bcb044726fdc77e7cde1667921ec707af42ad318f172265d19817d893a62
SHA3-384 hash: 7021ace113e9a0d815b863b5de4640d6ed2336977cd193854dd0149b42256e05b65df792362bedb69af2440f769c6e62
SHA1 hash: 1d0140d1afc4cbd86011fd2edab8772bd930a060
MD5 hash: e89111fec44b3951e81e0e28a8d9716d
humanhash: ceiling-jupiter-nineteen-freddie
File name:PEMBAYARAN COPY TT_PDF.gz
Download: download sample
Signature Loki
Create hunting rule
File size:703'133 bytes
First seen:2021-04-20 08:59:48 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:DH4jAd9he64nHu1NFUgyuIcdi1qRUgjeDFA1SkzDcO4ZurRSxPAAgT9o1:0WKNO1wgyutdNRU81Lp3cK+
TLSH 46E4234ECE99346DBE54BC8C118E52D985A9C77E750418F2229FB1EAF00D0FB6E52292
Reporter cocaman
Tags:gz Loki


Avatar
cocaman
Malicious email (T1566.001)
From: ""bca.global.trade@cbn.net.id" <ida@indopc.co.id>" (likely spoofed)
Received: "from mail.indopc.co.id (mail.indopc.co.id [103.253.68.149]) "
Date: "Mon, 19 Apr 2021 22:25:13 -0700"
Subject: "Slip Pembayaran - Pembayaran dikirimkan 20/04/2021 (Pengingat
Terakhir !!!)"
Attachment: "PEMBAYARAN COPY TT_PDF.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.667.16745.22119.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d80bcb044726fdc77e7cde1667921ec707af42ad318f172265d19817d893a62/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fwalzmceojx5y57hzxqwm6jb5ryhv5bk2mmpc4rglumyc7mjhjra._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210420-vy5pgerx8j/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://51.195.53.221/p.php/QmtRwnI3BJxHO
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2d80bcb044726fdc77e7cde1667921ec707af42ad318f172265d19817d893a62

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 2d80bcb044726fdc77e7cde1667921ec707af42ad318f172265d19817d893a62

(this sample)

Loki

Executable exe 8fa6706864df42149629c774b1b9804420f68c7c1642c92e674ba35bbdba12b5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8fa6706864df42149629c774b1b9804420f68c7c1642c92e674ba35bbdba12b5
  
Dropping
Loki

Comments