MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3944b429bf931ab06a980d4d15dfd69b5ea442c68938e0aee354e6c25311f94f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 12


Intelligence 12 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3944b429bf931ab06a980d4d15dfd69b5ea442c68938e0aee354e6c25311f94f
SHA3-384 hash: f91483d76ce4af063a9d1c9cfce8e6d9f9563d99f3e01ca8151f4816d9eb246e93fc439866041cbae77edd60fe627d4a
SHA1 hash: 586d0bd97d1996749531127dd9a406aa186ae7ab
MD5 hash: a781a01bfff6c0648192f32cdcd2ebe8
humanhash: iowa-double-maine-island
File name:3944b429bf931ab06a980d4d15dfd69b5ea442c68938e.exe
Download: download sample
Signature Loki
Create hunting rule
File size:475'075 bytes
First seen:2022-03-24 16:57:12 UTC
Last seen:2022-03-24 18:39:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (725 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 12288:t3eI9y8pkqXFyfdCY4+w93u5DwCdMJLwHneXnoA:t3eIo8pXFyVCYh1jdCw+XD
Threatray 10'286 similar samples on MalwareBazaar
TLSH T14EA4F1527FD012A2C6F40939C897D3368327EEA665514B83B3B47E193FBDA03A587724
File icon (PE):PE icon
dhash icon 70f0e0f0f0f0f071 (2 x Loki)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://164.90.194.235/?id=27270244207870876

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://164.90.194.235/?id=27270244207870876 https://threatfox.abuse.ch/ioc/447029/

Intelligence

File Origin
# of uploads :
2
# of downloads :
253
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/257251/
Detection(s):
PUA.Win.Trojan.Casino-141
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Creating a file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/11169/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/623ca320b94fb38cb4e46b4d/reports/d0db2d3e-2c6b-4034-947c-95d418613820/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/53db4c40-7e19-4c28-9955-60f2dfcc44f6
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/963901
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Found malware configuration
Hides threads from debuggers
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3944b429bf931ab06a980d4d15dfd69b5ea442c68938e0aee354e6c25311f94f/
Threat name:
Win32.Trojan.Shelsy
Create hunting rule
Status:
Malicious
First seen:
2022-03-24 16:58:13 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hfclikn7smnla2uybvgrlx6wtnpkiqwgre4oblxdkttmeuyr7fhq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
1432f0240c91b7439722df807e35ef9b4cc9b126f3e5d42cedb27b28751118d7
Loki
5ec36ac5ba843f29bb0dc75d7d527ab9cee34a681bad704a89fd5ed12cdea337
Loki
77353f06427f5e7d0e4c28e4d5690700a2cf6789edc0f9c51682dd20bb65bf78
Loki
8241caa4d6c5a09290864492d19dee143f0f80074d370135c0f91bad01c16ee3
Loki
b1999a87350ef2b15e663c809ac16f2f0832ba3dcd868aefe0d36392af04da29
Loki
c1dc214e929541d1f9d0ede9422bf40f61f766de5e8a32bc2fb2d73a91e4a71e
Loki
c1fa41f10a15d258d2edf7c06648ad2413ca25d7e2b4de2b45acfde204b1cf45
Loki
cfc09cd2a2109a174ccbc346779f2e19316be4601173e2e85c3e4314cc139017
Loki
dc5f7d89ab2465597ff7fa9f544326613aeaab2afa6e2e457ba5fc0da15bd450
Loki
fe5d8bb940112ba98d51c57496fa25e242d3f6e4b28b183bfe2ef3ec2c393e9e
Loki
+ 10'276 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:lokibot collection downloader spyware stealer suricata trojan
Link:
https://tria.ge/reports/220324-vgvvsagdel/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks QEMU agent file
Loads dropped DLL
Guloader,Cloudeye
Lokibot
suricata: ET MALWARE Generic .bin download from Dotted Quad
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://164.90.194.235/?id=27270244207870876
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
486fab01d83e3cfbe168fd3f8ff62389e935e8646ff3d4e28168599966a3c0c9
MD5 hash:
24dbed7aa74366d4fd9fa59ad11b56ad
SHA1 hash:
492fb3203a62f9674c4c4b8e0f32ca046a5292ae
Link:
https://www.unpac.me/results/5bae9c7f-cac7-4fdf-b9f9-16b2e26d2121/
SH256 hash:
3944b429bf931ab06a980d4d15dfd69b5ea442c68938e0aee354e6c25311f94f
MD5 hash:
a781a01bfff6c0648192f32cdcd2ebe8
SHA1 hash:
586d0bd97d1996749531127dd9a406aa186ae7ab
Link:
https://www.unpac.me/results/5bae9c7f-cac7-4fdf-b9f9-16b2e26d2121/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/3944b429bf93/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3944b429bf931ab06a980d4d15dfd69b5ea442c68938e0aee354e6c25311f94f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe 3944b429bf931ab06a980d4d15dfd69b5ea442c68938e0aee354e6c25311f94f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/257251/
  
URLhaus
https://urlhaus.abuse.ch/url/2114244/
  
Delivery method
Distributed via web download

Comments