MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30ae68254b23593ed9074e7122a9e790452a244fb6946431ad5baa122018a435. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30ae68254b23593ed9074e7122a9e790452a244fb6946431ad5baa122018a435
SHA3-384 hash: c1c65c8f614d002fc3ac7dc7db9db106c8d15e188b8df6deed262f34baf63d9df254fdf4c578cd9c1aaaff43a92271c1
SHA1 hash: 564f4adf499e31e1eb119a8894a57c8eb333511f
MD5 hash: bf00a8439d7b1091171b11e27ba0effa
humanhash: tennis-butter-kitten-uniform
File name:Transfer Request_pdf.gz
Download: download sample
Signature Loki
Create hunting rule
File size:229'706 bytes
First seen:2021-07-28 10:36:40 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:F3ETRM+MxoTihz9ay12r6fnumVO/Syn0V:r+Mxdz97kefbVOlC
TLSH T1FE2423B571BC4DFD1DA96522B28C70821E16EDC6D824E3E8200DE9D9C6F9CC0DB8B659
Reporter cocaman
Tags:gz Loki


Avatar
cocaman
Malicious email (T1566.001)
From: "Mohammed Dawsar Trabulsi <tdp@cyber.net.pk>" (likely spoofed)
Received: "from sg.sgalavitz.com (sg.sgalavitz.com [45.14.9.100]) "
Date: "28 Jul 2021 12:36:21 +0200"
Subject: "PAYMENT INSTRUCTION"
Attachment: "Transfer Request_pdf.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Smdd-6956905-0
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Gathering data
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2021-07-28 08:06:27 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gcxgqjklenmt5wihjzysfkphsbcsujcpw2kgimnnlovbeiayuq2q._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer suricata trojan
Link:
https://tria.ge/reports/210728-34qs5f28bj/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://185.227.139.18/dsaicosaicasdi.php/rVXhi7NTm83H7
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/30ae68254b23593ed9074e7122a9e790452a244fb6946431ad5baa122018a435

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 30ae68254b23593ed9074e7122a9e790452a244fb6946431ad5baa122018a435

(this sample)

Loki

Executable exe 44df96504ff0a727740da2a67982e2d214849ecf98a64de1ffcbf92bb46331a1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 44df96504ff0a727740da2a67982e2d214849ecf98a64de1ffcbf92bb46331a1

Comments