MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4061fb72cf023e7dbc619c0d3ee7c66e1acbb3810aba3fae2592f400d4ee1006. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4061fb72cf023e7dbc619c0d3ee7c66e1acbb3810aba3fae2592f400d4ee1006
SHA3-384 hash: a8d669c2b580eeafb84626a141b3f76d4129e8dec4923494d7bd6b8444826f49d571ee5ae73eb810318a762a9c8ee7fb
SHA1 hash: 75a1d3ae3054db04119a24e65f53884e0733f442
MD5 hash: 9a687ace431a49705adbcd7bfbbddcf6
humanhash: chicken-eleven-seven-kansas
File name:9a687ace431a49705adbcd7bfbbddcf6.exe
Download: download sample
Signature Loki
Create hunting rule
File size:206'639 bytes
First seen:2021-04-09 20:17:02 UTC
Last seen:2021-04-09 20:49:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 18bc6fa81e19f21156316b1ae696ed6b (51 x Formbook, 24 x Loki, 9 x SnakeKeylogger)
ssdeep 6144:HdYq6v+V6EBar10Eq/notTf+1eGYDJZeRfE5Ed6:le+3I10VkTfyAJZsEEd6
Threatray 4'653 similar samples on MalwareBazaar
TLSH 7B141347F3C18A3BF569A5300DA3E32BD37782610006674757649F6ABFA1903DF1B0AA
Reporter abuse_ch
Tags:exe Loki

Intelligence

File Origin
# of uploads :
2
# of downloads :
267
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9a687ace431a49705adbcd7bfbbddcf6.exe
Verdict:
Malicious activity
Analysis date:
2021-04-09 20:17:45 UTC
Tags:
installer
Link:
https://app.any.run/tasks/6e8a9922-effb-4412-a02a-ed29b942b3e2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/133451/
Detection(s):
SecuriteInfo.com.Troj.Agent-BGTI.32009.30020.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Modifying a system executable file
Unauthorized injection to a recently created process
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/671787
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to prevent local Windows debugging
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 384838 Sample: giATspz5dw.exe Startdate: 09/04/2021 Architecture: WINDOWS Score: 100 31 www.mashburneventcenter.com 2->31 33 mashburneventcenter.com 2->33 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 5 other signatures 2->47 11 giATspz5dw.exe 18 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\Temp\...\1ta8.dll, PE32 11->29 dropped 57 Detected unpacking (changes PE section rights) 11->57 59 Maps a DLL or memory area into another process 11->59 61 Tries to detect virtualization through RDTSC time measurements 11->61 63 Contains functionality to prevent local Windows debugging 11->63 15 giATspz5dw.exe 11->15         started        signatures6 process7 signatures8 65 Modifies the context of a thread in another process (thread injection) 15->65 67 Maps a DLL or memory area into another process 15->67 69 Sample uses process hollowing technique 15->69 71 Queues an APC in another process (thread injection) 15->71 18 explorer.exe 15->18 injected process9 dnsIp10 35 www.hstchwritr.com 156.231.30.137, 49763, 80 XHOSTSERVERUS Seychelles 18->35 37 www.resilientquality.com 142.4.204.181, 49766, 80 OVHFR Canada 18->37 39 19 other IPs or domains 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 22 wscript.exe 18->22         started        signatures11 process12 signatures13 51 Modifies the context of a thread in another process (thread injection) 22->51 53 Maps a DLL or memory area into another process 22->53 55 Tries to detect virtualization through RDTSC time measurements 22->55 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4061fb72cf023e7dbc619c0d3ee7c66e1acbb3810aba3fae2592f400d4ee1006/
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 23:50:37 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ibq7w4wpai7h3pdbtqgt5z6gnynmxm4bbk5d7lrfsl2abvhocada._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
397fd95899f186c1385818c6b996f4cb410e266a84b2c134104d01675a822e27
Loki
55f20748f621bf247877b71a3682640e5ec013d51c52363b5c51cca50b44c1bf
Loki
6bb8fa14bf9c650a67541ffedff2e3f1c055454b90489653c95aa39284d7eb92
Loki
a086821049463b0bfc414cb3763c4f82688182d2d018ae5c9cd472f59f9e36ff
Loki
be104552eacbe49cf13a5097c5856782c1b07531bd2eb2e4db5bcef7edc14b6a
Loki
cd292d4cdb5ff8f2de087a09de2a152722d910f1df7ce7b65e6480be9ae77fdf
Loki
e4938a8244543631ae11deb46e8b4cc3f0a8b8b7c2d4a1246f5bfadb29e0094c
Loki
f45a023c86d834183f3073c05227d6f40686aef4a71b3893b823be493d7aae83
Loki
f7e96b7c6612b709e413bbc8c72796cadbb7ce91ed17ec77d5ba4d4422e729cb
Loki
fd0cf58b93453778c312805f74673284da2548389ee866c37cc91431f0ba9cb1
Loki
+ 4'643 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210409-ksqef999qs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.zlzntiayc.icu/a6ru/
Unpacked files
SH256 hash:
7120a15a48799a9c1ab9e2335c7e9faaa56f48d0f94f22b7bb7dd9ab8db9dff3
MD5 hash:
e821d3b6ed6c917085735aa3def7b855
SHA1 hash:
a37cdcc64c28a9251442739de2e331dd1a9b5533
Link:
https://www.unpac.me/results/3588257e-ebdb-4c6b-b91c-29289b444c2b/
SH256 hash:
4061fb72cf023e7dbc619c0d3ee7c66e1acbb3810aba3fae2592f400d4ee1006
MD5 hash:
9a687ace431a49705adbcd7bfbbddcf6
SHA1 hash:
75a1d3ae3054db04119a24e65f53884e0733f442
Link:
https://www.unpac.me/results/3588257e-ebdb-4c6b-b91c-29289b444c2b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/4061fb72cf023e7dbc619c0d3ee7c66e1acbb3810aba3fae2592f400d4ee1006

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe 4061fb72cf023e7dbc619c0d3ee7c66e1acbb3810aba3fae2592f400d4ee1006

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1104232/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/133451/

Comments