MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43cf51d44bd94222fafaec38a2c80b0fbbecf761ed1cfba369e8e174fc157fb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 20


Intelligence 20 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43cf51d44bd94222fafaec38a2c80b0fbbecf761ed1cfba369e8e174fc157fb4
SHA3-384 hash: 0d894e4d8a7e37f249ccbca2d859bb316edd57497ae4bb4696f7ec294781ee25104d0beecca1e0f4c3cf54c7fb6a3ef7
SHA1 hash: 8527db09db74d040a757c458ea4400105c2b1f8d
MD5 hash: af7828de16ac18edbe5272bba019623a
humanhash: xray-robert-item-early
File name:125hGBgWz4WzJqk.exe
Download: download sample
Signature Loki
Create hunting rule
File size:535'040 bytes
First seen:2024-05-22 09:10:14 UTC
Last seen:2024-05-22 09:23:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:Qpkek4o3Yo0pMllbLtYQWdwy8xWwuXWgCj7Wl91H5iN:W7BoAMzbZ1+7EvQ1ZiN
Threatray 3'481 similar samples on MalwareBazaar
TLSH T1BAB4221E36C46623E43C4772D6F1020853BBBB663A13F3AA2ECC14D75D9BB40856974B
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://merckllc.top/kin/five/fre.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
405
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
43cf51d44bd94222fafaec38a2c80b0fbbecf761ed1cfba369e8e174fc157fb4.exe
Verdict:
Malicious activity
Analysis date:
2024-05-22 09:12:08 UTC
Tags:
lokibot stealer trojan
Link:
https://app.any.run/tasks/1a38bae5-f94f-463c-82e7-94138f27722f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.16786.26495.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=664db6e31b71b7491b3a2884win10vpnfull_triage
Tags:
Execution Network Stealth Lokibot
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Reading critical registry keys
Changing a file
DNS request
Connection attempt
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for analyzed file
Using the Windows Management Instrumentation requests
Stealing user critical data
Moving of the original file
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lokibot packed
Link:
https://www.filescan.io/uploads/664db6aec19b369e29fbf9b2/reports/fc47925d-8328-4fd6-9c5c-969ec3bc0383/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/43cf51d44bd94222fafaec38a2c80b0fbbecf761ed1cfba369e8e174fc157fb4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4d7f6e5f-5eb5-453a-b270-bc75e1f4c3a0
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1445623
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1445623 Sample: 125hGBgWz4WzJqk.exe Startdate: 22/05/2024 Architecture: WINDOWS Score: 100 42 merckllc.top 2->42 44 198.187.3.20.in-addr.arpa 2->44 50 Snort IDS alert for network traffic 2->50 52 Multi AV Scanner detection for domain / URL 2->52 54 Found malware configuration 2->54 56 14 other signatures 2->56 8 125hGBgWz4WzJqk.exe 7 2->8         started        12 XqVzFQw.exe 5 2->12         started        signatures3 process4 file5 38 C:\Users\user\AppData\Roaming\XqVzFQw.exe, PE32 8->38 dropped 40 C:\Users\user\AppData\Local\...\tmp880B.tmp, XML 8->40 dropped 58 Uses schtasks.exe or at.exe to add and modify task schedules 8->58 60 Adds a directory exclusion to Windows Defender 8->60 62 Injects a PE file into a foreign processes 8->62 14 125hGBgWz4WzJqk.exe 111 8->14         started        18 powershell.exe 23 8->18         started        20 powershell.exe 23 8->20         started        22 schtasks.exe 1 8->22         started        64 Antivirus detection for dropped file 12->64 66 Multi AV Scanner detection for dropped file 12->66 68 Tries to steal Mail credentials (via file registry) 12->68 70 Machine Learning detection for dropped file 12->70 24 schtasks.exe 12->24         started        26 XqVzFQw.exe 12->26         started        signatures6 process7 dnsIp8 46 merckllc.top 188.114.96.3, 49733, 49735, 49736 CLOUDFLARENETUS European Union 14->46 48 188.114.97.3, 60535, 60537, 60538 CLOUDFLARENETUS European Union 14->48 72 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->72 74 Tries to steal Mail credentials (via file / registry access) 14->74 76 Tries to harvest and steal ftp login credentials 14->76 78 Tries to harvest and steal browser information (history, passwords, etc) 14->78 80 Loading BitLocker PowerShell Module 18->80 28 conhost.exe 18->28         started        30 WmiPrvSE.exe 18->30         started        32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        36 conhost.exe 24->36         started        signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/43cf51d44bd94222fafaec38a2c80b0fbbecf761ed1cfba369e8e174fc157fb4
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/43cf51d44bd94222fafaec38a2c80b0fbbecf761ed1cfba369e8e174fc157fb4/
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2024-05-22 09:11:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iphvdvcl3fbcf6x25q4kfsalb656z53b5uopxi3j5dqxj7avp62a._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
5d7892602bc9f05c7978d801dba9300c0507222b48fc2f447a3c472f74d0b0f9
Loki
6f79a7492a3e9d4cd4af6142795f10fde07b3788253e6a75742b979168588038
Loki
9b7d88f0ea7556298e0dee39226de3688d8df6d237bfdb6d7ecfa7a8dac85bdf
Loki
+ 3'471 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection execution spyware stealer trojan
Link:
https://tria.ge/reports/240522-k5llxaac26/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Lokibot
Malware Config
C2 Extraction:
http://merckllc.top/kin/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/be9b6f21-c8c5-4514-9656-63b9ca67fa32
Unpacked files
SH256 hash:
9598ce5c93a570a317234eae1e94b110016aae7d211d8b0423d02a5a5fe0a5ab
MD5 hash:
281e2bfc7d7f58f433c33ab51e19bdb6
SHA1 hash:
fbbdafd54b803ad66ee77e369d045b94688fd5be
Link:
https://www.unpac.me/results/9a773460-f675-40e0-8208-d2f370b646f9/
SH256 hash:
0b7dcc18b0ef39734a24ca5923b02df82c670d08365fe376f2ed4ff9fcbc6303
MD5 hash:
0441cc0dacc6d821252e66a156b1d9bd
SHA1 hash:
df46cc702950a53a5de7b804d2076ef03f8ac6b4
Link:
https://www.unpac.me/results/9a773460-f675-40e0-8208-d2f370b646f9/
SH256 hash:
22b599b6f8d30c204f6e16e250f0aba5a11a7f8f897e664b9eacecd5d48e8665
MD5 hash:
154fb7a6b9c552ac4519a38d16b07d67
SHA1 hash:
d08bf0c78dbab65ea328ae90f137c592725d147d
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Lokibot
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
STEALER_Lokibot
Create hunting rule
Link:
https://www.unpac.me/results/9a773460-f675-40e0-8208-d2f370b646f9/
SH256 hash:
2d9da9b03cbd20b47a292376ae7eb1d6cbf1e81549b26b53db767f8ceda705cd
MD5 hash:
c98da162ac35780b770f3475e17ec924
SHA1 hash:
555fbc70b564be8256042b84a3072f69b053f5c5
Link:
https://www.unpac.me/results/9a773460-f675-40e0-8208-d2f370b646f9/
SH256 hash:
43cf51d44bd94222fafaec38a2c80b0fbbecf761ed1cfba369e8e174fc157fb4
MD5 hash:
af7828de16ac18edbe5272bba019623a
SHA1 hash:
8527db09db74d040a757c458ea4400105c2b1f8d
Link:
https://www.unpac.me/results/9a773460-f675-40e0-8208-d2f370b646f9/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/43cf51d44bd9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/43cf51d44bd94222fafaec38a2c80b0fbbecf761ed1cfba369e8e174fc157fb4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifacts observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:Windows_Trojan_Lokibot_0f421617
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Lokibot_1f885282
Create hunting rule
Author:Elastic Security
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments