MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 445e1ae4fb515ce4fca81255fc4f569ba238d2a7b3ba0c093f4d55bc8fa5ae08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 445e1ae4fb515ce4fca81255fc4f569ba238d2a7b3ba0c093f4d55bc8fa5ae08
SHA3-384 hash: 7978e3084174e8f7ad032f1e1e91eae2c19db0fef3cc2ed785546214bd9a1757d8184ff3206b1826e46aff3b7929e175
SHA1 hash: e34b1e0c2813bf540a7d3c5e8d0cfecfe5fec164
MD5 hash: 66d95510f3a550106e1bd6d3dd187865
humanhash: winner-july-twenty-blossom
File name:MOM Daily attendance uodate form·pdf.exe
Download: download sample
Signature Loki
Create hunting rule
File size:412'672 bytes
First seen:2021-01-19 07:19:31 UTC
Last seen:2021-01-19 09:21:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 616765ca1e3c367f5f3771d38d13b610 (7 x Loki, 4 x RemcosRAT, 4 x AgentTesla)
ssdeep 6144:r3CDRM9sIkrdnvEgUmCeya1sDkqQz0VYuksW5w0BQtSJeYeVFgtG:rf9HmdvEKCehSDkqQALk60Bdw/atG
Threatray 2'326 similar samples on MalwareBazaar
TLSH 18947C62618FE433D022027243E4E6530579BDF30F2F68AF9BD969BD09F6CD1622571A
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: cloudhost-2060988.uk-south-2.nxcli.net
Sending IP: 165.84.218.167
From: MOM ACE (No Reply) <no_reply_ace@mom.gov.sg>
Subject: Swab Registration System : Daily Attendance update
Attachment: MOM Daily attendance uodate form·pdf.zip (contains "MOM Daily attendance uodate form·pdf.exe")

Loki C2:
http://51.195.53.221/p.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MOM Daily attendance uodate form·pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-01-19 07:21:24 UTC
Tags:
trojan lokibot stealer
Link:
https://app.any.run/tasks/bf51c21d-91fa-4388-baff-3da790b310d0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/112756/
Detection(s):
PUA.Win.Adware.Bang5mai-6804572-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process from a recently created file
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/584790
Signature
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/445e1ae4fb515ce4fca81255fc4f569ba238d2a7b3ba0c093f4d55bc8fa5ae08/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-19 01:46:09 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=irpbvzh3kfooj7ficjk7yt2wtordruvhwo5aycj7jvk3zd5fvyea._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
0b813805cdf296dc50f3336dcbf6e41f4dc119e753be9511634857eba90a7b0f
Loki
35f2d31f591a7850c05f86c1124aef7193bdd2f2ad7421d1fb09e1144b3fc3d3
Loki
400f9673e8739dbce3f10c37b62e93789563acd0a57364e7c6cbc841eaac9696
Loki
7c543362b23c8618d029f1fff5185c8af6adaaa3a6f358d4c8415e8e71ae7818
Loki
88fefe74a59525eecee004f0ca10e3b964462adc1f3b44a794282e17dd3dd67e
Loki
8f381987b6d04acb2f13d81524cd91deed670b4e678d34fc3960278a28cc4eb6
Loki
9dd8b9b40de05ac0aaf1bb9e1710faea9ef584f5eff71d3af7ad3a2dc083649f
Loki
b40eb6fd6c232b3359d55b0a4a2392196dd37b4fd6fc3fbe64637caa1a817042
Loki
b8f93d593fb0feaa265c385ab4afb8c8e1bb7908b166cf68b6efb36ed1f7fa4f
Loki
e3699291676cb658693307f1f568e8ae9d82e50f3b2a3c3031437c5d54fe7c16
Loki
+ 2'316 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210119-61ytxynhz2/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://51.195.53.221/p.php/pXqVbj1ory8MD
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
b1f5505948535db9e353ebdfb87d8431a0bd559374d0c0de3152784a2f300e72
MD5 hash:
c9258d73175b7908277ec26a9bc98b8d
SHA1 hash:
01c6fb15e6f845370b2d40ab2eb2e659229f7e21
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/7c6447c7-96b8-4085-8595-0842cfc2b0ff/
Parent samples :
445e1ae4fb515ce4fca81255fc4f569ba238d2a7b3ba0c093f4d55bc8fa5ae08
f5078fdbde359885628dd3d3c1df88b7255ece2dba7a1b26b44fdce580fc3ff7
SH256 hash:
445e1ae4fb515ce4fca81255fc4f569ba238d2a7b3ba0c093f4d55bc8fa5ae08
MD5 hash:
66d95510f3a550106e1bd6d3dd187865
SHA1 hash:
e34b1e0c2813bf540a7d3c5e8d0cfecfe5fec164
Link:
https://www.unpac.me/results/7c6447c7-96b8-4085-8595-0842cfc2b0ff/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/445e1ae4fb515ce4fca81255fc4f569ba238d2a7b3ba0c093f4d55bc8fa5ae08

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 7372e070a13a97907cff9b0bc08372f78d0ee33d9c78d254d0a856228a2e6aa3

Loki

Executable exe 445e1ae4fb515ce4fca81255fc4f569ba238d2a7b3ba0c093f4d55bc8fa5ae08

(this sample)

  
Dropped by
MD5 05205675eaf87569f9d61893bdd145d3
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/112756/
  
Dropped by
SHA256 7372e070a13a97907cff9b0bc08372f78d0ee33d9c78d254d0a856228a2e6aa3

Comments