MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43a90fad356464953de14ff41ea31363b371d8612c4b411c397ce1df377fd2b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43a90fad356464953de14ff41ea31363b371d8612c4b411c397ce1df377fd2b1
SHA3-384 hash: f3519d497be3fbac6607378b837c95526989d6a80cdb29d7eb30d88b4a8f40630c625eb671b2779ca29e4493a2a20d89
SHA1 hash: 0a636ed45095686dcacf116acd1607310a4c0679
MD5 hash: d34220b859ea98b86761794b9e581d53
humanhash: uranus-oxygen-failed-friend
File name:d34220b859ea98b86761794b9e581d53
Download: download sample
Signature Loki
Create hunting rule
File size:391'680 bytes
First seen:2021-07-09 04:00:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:ctnDuqI8uCJjuCn6iQUB8CHPku8TvKNK6KSKBuv5IpM8XLXpchuoHUbwUotsLCli:CW8uCJjuCn6iQUB8CHPku8TvKNK6KSKr
Threatray 3'484 similar samples on MalwareBazaar
TLSH T14284E18156ACA93EC5DB87F6DF225B402D73AF4BD0A090C171AE7A767372F80B943548
Reporter zbetcheckin
Tags:32 exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d34220b859ea98b86761794b9e581d53
Verdict:
Suspicious activity
Analysis date:
2021-07-09 04:02:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6eb308e4-700e-42cc-aa5c-fe6e79e757d1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/170598/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.919.29884.5178.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d229a521-b66f-4432-8f7c-80e4a86d8556
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/813846
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 446257 Sample: OwLU0nTrfc Startdate: 09/07/2021 Architecture: WINDOWS Score: 100 44 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->44 46 Multi AV Scanner detection for domain / URL 2->46 48 Found malware configuration 2->48 50 8 other signatures 2->50 6 OwLU0nTrfc.exe 1 7 2->6         started        10 chrom.exe 3 2->10         started        12 chrom.exe 5 2->12         started        process3 file4 30 C:\Users\user\AppData\Roaming\...\chrom.exe, PE32 6->30 dropped 32 C:\Users\user\AppData\...\OwLU0nTrfc.exe, PE32 6->32 dropped 34 C:\Users\user\...\chrom.exe:Zone.Identifier, ASCII 6->34 dropped 40 2 other malicious files 6->40 dropped 52 Writes to foreign memory regions 6->52 54 Injects a PE file into a foreign processes 6->54 14 OwLU0nTrfc.exe 54 6->14         started        36 C:\Users\user\AppData\Local\Temp\chrom.exe, PE32 10->36 dropped 38 C:\Users\user\...\chrom.exe:Zone.Identifier, ASCII 10->38 dropped 18 chrom.exe 10->18         started        20 chrom.exe 10->20         started        22 chrom.exe 12->22         started        24 chrom.exe 12->24         started        26 chrom.exe 12->26         started        28 chrom.exe 12->28         started        signatures5 process6 dnsIp7 42 209.141.34.39, 49725, 49726, 49727 PONYNETUS United States 14->42 56 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->56 58 Tries to steal Mail credentials (via file registry) 14->58 60 Tries to steal Mail credentials (via file access) 14->60 64 2 other signatures 14->64 62 Machine Learning detection for dropped file 22->62 signatures8
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/43a90fad356464953de14ff41ea31363b371d8612c4b411c397ce1df377fd2b1/
Threat name:
Win32.Trojan.CrypterX
Create hunting rule
Status:
Malicious
First seen:
2021-07-09 04:01:09 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iouq7ljvmrsjkppbj72b5iytmozxdwdbfrfuchbzptq56n372kyq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
0d9b5c176c7db0c067711afadce4630e5be2671d9f9431d5291e702d0b4cabad
Loki
691c65e4fb1d19f82465df1d34ad51aaeceba14a78167262dc7b2840a6a6aa87
Loki
7c72d2e12ed2db6353a373d16c07eaf27fbf110c75a2dc7535ec7d624cb42012
Loki
8e79e3ed462ebedbdabbc9462e5448e24a43c70256b3ba5f3575aea25cfac787
Loki
95adc30ed6495e078a795b6184442b4147e87e1e48bd040467c0d190cabbf092
Loki
97e8e53c9ad758050c08da0cf14f7024dba1d7710b0f612f13d2b5a458dd13bb
Loki
a376668a48de6be4c4f85e7abc40fb3806580c2733912c6e400db843e41aa056
Loki
a6dcb375ec518dc845d50e3508c30168f0f12f9e28f221e14734c52fb7f29942
Loki
ab1cef822f66d7b77574a21c8154d4a6e9fcd196a6659637f1d662f0ef7df3bd
Loki
c03b5d783971f4ab3ae3dac1b9576acfc0334cd919ffd74bb6ac01cbef2b128d
Loki
+ 3'474 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot persistence spyware stealer trojan
Link:
https://tria.ge/reports/210709-krm8gq1xgx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Lokibot
Malware Config
C2 Extraction:
http://209.141.34.39/pote/pin.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
1ed4bc58708a674c276ef96a96ac3d3c6cab1ac1da36dadc73b5be12fcf230bc
MD5 hash:
7b912a0f758c107ab2293d8a787da594
SHA1 hash:
c16cc8a24e1e28bc9f7eaa2f4411ad24c61d25ee
Link:
https://www.unpac.me/results/26560687-540d-428c-b8cb-b9dffba957c7/
SH256 hash:
e77623805f363d6aa6d694b8de95779bf116e511d63d845f4113c5bf19885248
MD5 hash:
afa53f0751be4711dcffa23480f66f8d
SHA1 hash:
a4535d116d747bbd72a3a0d77bb7e51b2d27c093
Link:
https://www.unpac.me/results/26560687-540d-428c-b8cb-b9dffba957c7/
SH256 hash:
ef1e9b0584c20e87c5b2815db611efbe45726555065ef44eb4bdbc28792e219d
MD5 hash:
90998c7b62a71e37052a810817164515
SHA1 hash:
8690bce3948c3b55c193172467a77384143de750
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/26560687-540d-428c-b8cb-b9dffba957c7/
Parent samples :
00dc81db82fd264aa369b855dc21957ad780742f0f62ab3d62408e13a457199d
d70f6f599cff525b117325b63eb2b77f07b8569df8f7d9afdffe2125d2814f8e
43a90fad356464953de14ff41ea31363b371d8612c4b411c397ce1df377fd2b1
SH256 hash:
43a90fad356464953de14ff41ea31363b371d8612c4b411c397ce1df377fd2b1
MD5 hash:
d34220b859ea98b86761794b9e581d53
SHA1 hash:
0a636ed45095686dcacf116acd1607310a4c0679
Link:
https://www.unpac.me/results/26560687-540d-428c-b8cb-b9dffba957c7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/43a90fad356464953de14ff41ea31363b371d8612c4b411c397ce1df377fd2b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe 43a90fad356464953de14ff41ea31363b371d8612c4b411c397ce1df377fd2b1

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1437817/
Cape
Cape
https://www.capesandbox.com/analysis/170598/

Comments


Avatar
zbet commented on 2021-07-09 04:00:39 UTC

url : hxxp://lifestyledrinks.hu/wp-includes/cs3/PL_0260_63_108_117.exe