MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fcc813e2c8b554f99146b1b0a44de18f3d15467bb7fcd975c364b8190dea8b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	2fcc813e2c8b554f99146b1b0a44de18f3d15467bb7fcd975c364b8190dea8b4
SHA3-384 hash:	41b799ac71e5cd425c351eeded512d81f3a5e92082372e8b31bba0cf41743590af6930fb57842f294bfba6ea5a9d9413
SHA1 hash:	3d0f7ccfd307989df9c6101357d739e59603c51a
MD5 hash:	f42c43c52f7b18bd4a7957df0d7c63d0
humanhash:	triple-lake-mobile-west
File name:	documents.zip
Download:	download sample
Signature	Loki Create hunting rule
File size:	602'452 bytes
First seen:	2022-06-06 06:50:27 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:XAuZpCtW5ibNn2U6HK3b9Bk3p2+hKVJLwllLARilbNKOi963MP:wu7CtWYuyY2+c3Lwf0RilNKO8P
TLSH	T156D423E6DC431A96C99C1E3C7E3960A7C5AA06BEDFC3323934A64507C792952E4C1BA1
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	Loki zip

cocaman

Malicious email (T1566.001)
From: "rahul.dandavate@liebherr.com" (likely spoofed)
Received: "from liebherr.com (unknown [185.222.57.211]) "
Date: "04 Jun 2022 19:49:48 +0200"
Subject: "RE: Shipment Docs"
Attachment: "documents.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

270

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL

Sanesecurity.Malware.22270.ZipHeur.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fareit obfuscated packed

Link:

https://www.filescan.io/uploads/629da3d7a2b1fc9744d0a02b/reports/44dd93f2-6f54-4185-ae66-e21f7572a891/overview

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/2fcc813e2c8b554f99146b1b0a44de18f3d15467bb7fcd975c364b8190dea8b4

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2fcc813e2c8b554f99146b1b0a44de18f3d15467bb7fcd975c364b8190dea8b4/

Threat name:

ByteCode-MSIL.Trojan.LokiBot

Status:

Malicious

First seen:

2022-06-04 14:27:20 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f7gicprmrnku7giunmnqurg6ddz5cvdhxn743f24gzfydeg6vc2a._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220606-hmgh5aedg6/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

https://blinkcard.co.vu/shin/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2fcc813e2c8b554f99146b1b0a44de18f3d15467bb7fcd975c364b8190dea8b4