MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41e46f6907e7ef47062aca5bb3c5312366538839dea2627c6cb68f3e913e1a87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41e46f6907e7ef47062aca5bb3c5312366538839dea2627c6cb68f3e913e1a87
SHA3-384 hash: 49f664ebfa39df4f1eba1871d54007041c3528baea9efb67e5240d3689ceba4c09ede0eae2e727bfe5f8d8981dc59b50
SHA1 hash: 0ed458134dad3d0a6377b9d5b980fc0cf777c33c
MD5 hash: 9d0eb6cd00e68f49e474bd6df8fb8c53
humanhash: venus-tango-undress-happy
File name:COMMERCIAL INVOICE -21538203853#.exe
Download: download sample
Signature Loki
Create hunting rule
File size:925'184 bytes
First seen:2021-05-17 21:25:38 UTC
Last seen:2021-05-17 21:44:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 24576:ipamWjFWwKMuvrNvuXspw8HGoAW5H13mN4qDAhmmfHzil:i+WQujJb+W5H13mN4qDGPzil
Threatray 295 similar samples on MalwareBazaar
TLSH 8715BF01B1D105E8E76E7F7383AB79707FA562879463E154FC8E0A15C2B3B44DE8868B
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://optimalwellengineering.com/wp0041/five/fre.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://optimalwellengineering.com/wp0041/five/fre.php https://threatfox.abuse.ch/ioc/44062/

Intelligence

File Origin
# of uploads :
2
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
COMMERCIAL INVOICE -21538203853#.exe
Verdict:
Malicious activity
Analysis date:
2021-05-17 21:27:23 UTC
Tags:
trojan lokibot stealer
Link:
https://app.any.run/tasks/8adfb991-2786-4240-bd1a-2e759ced6d95

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/157958/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.747-1.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.W32.MSIL_Kryptik.DLO.genEldorado.16554.24954.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/783785
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/41e46f6907e7ef47062aca5bb3c5312366538839dea2627c6cb68f3e913e1a87/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-05-17 21:26:09 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ihsg62ih47xuobrkzjn3hrjrentfhcbz32rge7dmw2ht5ej6dkdq._file
Verdict:
unknown
Similar samples:
212fa99c63cef30d1c9738b16139ee494eccca1f8d85d499088aeff2dfd4b42d
Loki
408d0b8cf4df11f74ecd574dccdcc5bc7fdf483fce512401e0c767e801815357
Loki
4e9d4accd47dc415c57f8c246d5e7a80b57eb0428380ec6fad4daf99e35494fe
Loki
7c98a7aee7d155bc8632cae1ff09120f88483adfa77205e6b74253e9d652e2b6
Loki
b90fb49ced2711300981110e8d872b5b2848ea3449ef2db157df053dc6fe49c1
Loki
c8ae2ba5bc167ab220f8d6e57d6672f64093b7c8e54fee7b810614ec98641aeb
Loki
db6863fdde8111c668522696e503145c0f988ad14c248fbba9ecd4a23de83613
Loki
ea1dfb8b4d49ed0725305093b1a5466d5ab339ba2a5b125db5f3b87c42b874ea
Loki
efa63822d503d39c7cf4ed12eea7c23780a146214aafcf5b74a18b859c5ab5ca
Loki
f89ad254eee3edda82a6ea8811ca2b9513188f83ffb4ed778676d996e850b465
Loki
+ 285 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210517-hzpze6bjrs/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://optimalwellengineering.com/wp0041/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/157958/

Comments