MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b517bd525c1fe0bc68345c0f922dd0e3a88282dc162a1758ce909e525d38493. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	3b517bd525c1fe0bc68345c0f922dd0e3a88282dc162a1758ce909e525d38493
SHA3-384 hash:	eb6afe461c29f75da725b5966c230406da41fac1be688ad2bd24075dda1894fc074de7dd2b2e8d637244f576cb8e36f6
SHA1 hash:	01b381e6bf7b7f0b444819a0840d852680240fb0
MD5 hash:	bd190cedd1b3f9044b4e65d9919e36c9
humanhash:	stream-six-saturn-item
File name:	gunzipped
Download:	download sample
Signature	Loki Create hunting rule
File size:	872'752 bytes
First seen:	2020-10-20 08:34:01 UTC
Last seen:	2020-10-25 18:14:53 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	6144:46W76dfjb9qpb17MH2HXPWLifk5/IxBGDGyYZTOW/vh:QyjQP585/cBGDGyYZTtx
Threatray	1'676 similar samples on MalwareBazaar
TLSH	AB0540292A8C2C7ADCB3E97C2F72994589B175FE1892C7748694E8D853F75103F1BA03
Reporter	abuse_ch
Tags:	Loki SCB

abuse_ch

Malspam distributing Loki:

HELO: server3799.whm-secure.com
Sending IP: 95.128.135.195
From: Standard Chartered Bank <notice@sc.com>
Subject: Your beneficiary advice from Standard Chartered branch//subsidiary
Attachment: payment slip.gz (contains "gunzipped")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

DNS request

Launching a process

Creating a process with a hidden window

Unauthorized injection to a recently created process

Adding an access-denied ACE

Reading critical registry keys

Changing a file

Replacing files

Launching the default Windows debugger (dwwin.exe)

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Creating a window

Sending a TCP request to an infection source

Stealing user critical data

Connection attempt to an infection source

Moving of the original file

Sending an HTTP POST request to an infection source

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/497338

Signature

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Connects to a pastebin service (likely for C&C)

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3b517bd525c1fe0bc68345c0f922dd0e3a88282dc162a1758ce909e525d38493/

Threat name:

ByteCode-MSIL.Backdoor.Androm

Status:

Malicious

First seen:

2020-10-20 02:23:44 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hnixxvjfyh7axrudixapsiw5by5iqkbnyfrkc5mm5ee6kjotqsjq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

spyware trojan stealer family:lokibot

Link:

https://tria.ge/reports/201020-wn1sw7al8x/

Behaviour

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: RenamesItself

Program crash

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://195.69.140.147/.op/cr.php/eQsZGMAClLCl6
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php