MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37d995fa34e22498b1823b9b98edb207014357a673f21b560be3f2b65cb8ef10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments

SHA256 hash:	37d995fa34e22498b1823b9b98edb207014357a673f21b560be3f2b65cb8ef10
SHA3-384 hash:	aa0208d9e547370097053f1cc318087eb4fee044813a51ccce31f114ce9fa58155dc6caad4e3576d2cae9c229b5779ed
SHA1 hash:	b9cb90914c7d60b7ccd63ce89f452ad86c84d980
MD5 hash:	eed4d178cbab3caba57826254934d69c
humanhash:	venus-georgia-magazine-quiet
File name:	Quotation_71042780 Request.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	759'136 bytes
First seen:	2021-03-09 15:48:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0c4ee73e2314625013995d8fcbbc1e29 (3 x Formbook, 2 x NetWire, 1 x Loki)
ssdeep	12288:IWvotGuCXzMfmdGec+DWs26KD/pxMIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIL:IWvIEym4yZepmIIIIIIIIIIIIIIIIIIb
Threatray	2'591 similar samples on MalwareBazaar
TLSH	59F4BF33E291587BC5772634AE1B426CAD35BE102B7CE84A27E59C8C4F3B7813D16297
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Malspam distributing unidentified malware:

HELO: mail.aav.local
Sending IP: 213.154.48.68
From: Biofabrik Refinery GmbH <mohamedha@aav.com.eg>
Subject: URGENT QUOTATION REQUEST
Attachment: Quotation_71042780 Request.rar (contains "Quotation_71042780 Request.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

124

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Quotation_71042780 Request.exe

Verdict:

Malicious activity

Analysis date:

2021-03-09 16:06:51 UTC

Tags:

trojan lokibot stealer

Link:

https://app.any.run/tasks/ba3afc27-b868-4873-b6d2-5167d570386a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/123304/

Detection(s):

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Sending a custom TCP request

Creating a file

Deleting a recently created file

Unauthorized injection to a recently created process

Sending a UDP request

Reading critical registry keys

Changing a file

Replacing files

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Moving of the original file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/633128

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Executables Started in Suspicious Folder

Sigma detected: Execution in Non-Executable Folder

Sigma detected: Suspicious Program Location Process Starts

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Gathering data

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2021-03-09 12:09:12 UTC

AV detection:

21 of 46 (45.65%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g7mzl6ru4isjrmmchonzr3nsa4augv5gopzbwvql4pzlmxfy54ia._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot persistence spyware stealer trojan

Link:

https://tria.ge/reports/210309-bt3bjapa82/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

Lokibot

Malware Config

C2 Extraction:

http://taker2.xyz/V2/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php