MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 323dfe748192de2c66729a6b781f73188233d4cf2efef722271499a047847011. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	323dfe748192de2c66729a6b781f73188233d4cf2efef722271499a047847011
SHA3-384 hash:	9e0c86278b5d4031b0ea64a2badd5708a15d155c07814923aacec62e1897cea6869d4b6be69aea58cabac4e9f137bf06
SHA1 hash:	a43dfbd37e48068a2f52343dfbc91e0977ae7c32
MD5 hash:	51e0b6c565bf6b22f2b0e9312332ff69
humanhash:	indigo-utah-pip-oscar
File name:	Maerskline Receipt.rar
Download:	download sample
Signature	Loki Create hunting rule
File size:	525'260 bytes
First seen:	2022-11-28 08:10:05 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:3grEZJp9RgpcEiGxt1Q8p3knv7vk/zIGxKBxdPPeNR1NX9i7agxOv:hZH9RscE/xjQ8p3kI/Uu4jPs1V9Tgcv
TLSH	T1A4B42385E1BF08E7390529EC745E1C13F82B5C0CBA5982A5D49C24D8F50BE2B7F4AB5B
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	Loki Maersk rar

cocaman

Malicious email (T1566.001)
From: "Maersk Line <maerskline@wx15.ovxm.live>" (likely spoofed)
Received: "from hp0.wx15.ovxm.live (unknown [134.122.33.67]) "
Date: "Mon, 28 Nov 2022 00:01:13 -0800"
Subject: "Maerskline Shipment Notification"
Attachment: "Maerskline Receipt.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

162

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Purchase Inquiry.exe
File size:	738'304 bytes
SHA256 hash:	7329528ead7542c9af48aeff33fcfa265731b53ad352af1efc3666911f115090
MD5 hash:	bbf8cc59cbe4cd8d3845c1499335c07f
MIME type:	application/x-dosexec
Signature	Loki

Vendor Threat Intelligence

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/63846d15559d07a06f47e8f5/reports/5bdb258b-e0f3-4b71-9271-7bc51aef8db9/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/323dfe748192de2c66729a6b781f73188233d4cf2efef722271499a047847011/

Threat name:

ByteCode-MSIL.Trojan.Leonem

Status:

Malicious

First seen:

2022-11-28 04:40:42 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

21 of 26 (80.77%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gi6745ebslpcyztstjvxqh3tdcbdhvgpf37poirhcsm2ar4eoaiq._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/221128-kg29raab45/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://157.245.36.27/~dokterpol/?page=14914169539334
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/323dfe748192de2c66729a6b781f73188233d4cf2efef722271499a047847011

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.