MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36f84bac671a041b1c04f90d16e70229ba56d8a87d0fa82f2f46a84079edaca7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36f84bac671a041b1c04f90d16e70229ba56d8a87d0fa82f2f46a84079edaca7
SHA3-384 hash: cf5860499f881a6e995020fca6edc876c17b577bc0f2e7c575b8e74f0ad035a99af420907f713cdf56a92de3567d5eb0
SHA1 hash: 5a8f68e81bf63c30d045cd95265eac33fb1abacd
MD5 hash: a88063e7b114daad692f225a9573e892
humanhash: football-early-jersey-california
File name:PO.exe
Download: download sample
Signature Loki
Create hunting rule
File size:512'000 bytes
First seen:2020-10-06 06:31:32 UTC
Last seen:2020-10-06 08:12:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:p/6cVulXLQkHpH7E4UA7MJ0EonVwwW7I8zKnpMFtw:UnXLQwpHQ4JpEoKu8f
Threatray 1'543 similar samples on MalwareBazaar
TLSH B9B4F11923B4DB14C1BE677AB421501067F0A90BD722F39DFEEA70ADB973A80CD55B81
Reporter abuse_ch
Tags:exe geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: mail-smail-vm28.hanmail.net
Sending IP: 203.133.180.210
From: 셀텍 <celltec@hanmail.net>
Subject: 요청자료목록
Attachment: PO.cab (contains "PO.exe")

Loki C2:
http://79.124.8.8/plesk-site-preview/coautomaquinaria.com/http/79.124.8.8/ekene/Panel/fre.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68489/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Reading critical registry keys
Changing a file
Replacing files
Creating a file in the %AppData% subdirectories
Stealing user critical data
Connection attempt to an infection source
Moving of the original file
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/482473
Signature
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/36f84bac671a041b1c04f90d16e70229ba56d8a87d0fa82f2f46a84079edaca7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 05:05:28 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g34exldhdicbwhae7egrnzycfg5fnwfipuh2qlzpi2uea6pnvstq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
3174c59112b25985b8c1454e28c3e42dce2e6b44e3da96d891bfd25622e586ea
Loki
59bbe3f3c9d04d180126b1396dcda25f533a491a92255ffdfca4acb6a6ca7bfa
Loki
5a6ff674194fd8f0b7221de0d402f383eec634054768bd2df0e7adc2fa825953
Loki
8ab355a4e825d4b233ce66f8e5f5b75b4c161cbb25f070f3355b6b15625dc784
Loki
9a09e075c72d1054035ab56fc790933d097a8a3986e0a1eca8b925606d304956
Loki
9d9e3278180f9d8b038c943eaf74a91002f30ff456bc7e8dfef40ef1a4e8fb4a
Loki
aedef2c77ed57c78a04e0744ebd77d6d2dfb743276ca83c39ebb9afd93123704
Loki
c40de93b6a12855b8fe84ab03b11e849bf536cb3efa20bcc544b71998429bede
Loki
f79cacba0a21dcaf056a47d6bcd4082ed19c4267568ee46f75b16448e1d98945
Loki
fa2bcbff57b3c111ea69b6f47cb4f39c4111b124ef97e3ee00347a175f67e93d
Loki
+ 1'533 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
spyware trojan stealer family:lokibot
Link:
https://tria.ge/reports/201006-6znwnsaprx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://79.124.8.8/plesk-site-preview/coautomaquinaria.com/http/79.124.8.8/ekene/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
637504848310f205cad5ed99555c84fce3e39e63959797430345a7e94faf8272
MD5 hash:
dc15c7cf000ac372ce7c5ed88f8c045c
SHA1 hash:
10a6a7bb9efb22db1a3e45349f2c3a63552290d0
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/190a2435-507a-4480-ad55-8983431b00f5/
Parent samples :
645c0709512e3abe9794777c7b49ef75ca1b698fbeff13642da042b8c4def95f
ef25f3865fafd2c357f5a68e0d18ffb0bf5d522675abeef4599c210f9f12a9e2
36f84bac671a041b1c04f90d16e70229ba56d8a87d0fa82f2f46a84079edaca7
1957889d188ba3fd7df0ac9e3fe2505d5bd8576865fb96907fc52ad4517db8b1
SH256 hash:
13b24d3a09d099dabe41cd6cd71607a77e14640b1e9b4ed2d60f6c012f191c43
MD5 hash:
109cedae3c384a1913107f1efad2b7c8
SHA1 hash:
1f7f35b0ed85fa12bb839cbce698e59a30813420
Link:
https://www.unpac.me/results/190a2435-507a-4480-ad55-8983431b00f5/
SH256 hash:
c13654dc87217477e08800c7f4ed6deb33b7c20146f59c82253515e769b01cce
MD5 hash:
6d2b48358ba70c18f259b81cf8c75a2b
SHA1 hash:
b1991bbe87e0841e361c984578db6e0d4ae49185
Link:
https://www.unpac.me/results/190a2435-507a-4480-ad55-8983431b00f5/
SH256 hash:
d8951ad38415aaef072163beb8f42ca4c918a05915910120f85f98ce48b4e0db
MD5 hash:
5cfaec60e082d38e49e9f3b847bc03f4
SHA1 hash:
d51926564055f6dc5a3a8eae071a0f34a73e1419
Link:
https://www.unpac.me/results/190a2435-507a-4480-ad55-8983431b00f5/
SH256 hash:
36f84bac671a041b1c04f90d16e70229ba56d8a87d0fa82f2f46a84079edaca7
MD5 hash:
a88063e7b114daad692f225a9573e892
SHA1 hash:
5a8f68e81bf63c30d045cd95265eac33fb1abacd
Link:
https://www.unpac.me/results/190a2435-507a-4480-ad55-8983431b00f5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/36f84bac671a041b1c04f90d16e70229ba56d8a87d0fa82f2f46a84079edaca7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab d699e91e9b69d86cff390ebe75faf4b3a2fde82b0b2e095bb5de833498da53bf

Loki

Executable exe 36f84bac671a041b1c04f90d16e70229ba56d8a87d0fa82f2f46a84079edaca7

(this sample)

  
Dropped by
MD5 af618e82ba5d249aafa7d54fb428fe3e
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/68489/
  
Dropped by
SHA256 d699e91e9b69d86cff390ebe75faf4b3a2fde82b0b2e095bb5de833498da53bf

Comments