MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44ff3239ff43648e6a0bdd377505fad2f5f3d03e7a4abf475fa4db047de10675. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	44ff3239ff43648e6a0bdd377505fad2f5f3d03e7a4abf475fa4db047de10675
SHA3-384 hash:	c01cd484bf6fda8e84a469b07dfc4440acd518d7870360e6323aeec2da647cc552177b8fef1c43aa309b95655a0d3ae9
SHA1 hash:	a7a968b5565a96a4678bcbc832737d58b35f627a
MD5 hash:	fa8c3adb945a1abd0a8d11dec0a88d7c
humanhash:	undress-stairway-cardinal-snake
File name:	DHL Receipt_AWB811470484778.rar
Download:	download sample
Signature	Loki Create hunting rule
File size:	413'342 bytes
First seen:	2022-05-13 06:30:56 UTC
Last seen:	2022-05-13 08:37:43 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:XmcNUqtneUVNAQIHcrKIWnl09Q7LnSuCPaorb2C:dBjNAQItIWncqLnhC1GC
TLSH	T10C9423B41485CE6E1672BC3F6607E2E3CAEC70B91D80F1AEDE1B175BCDC59A60026197
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	DHL Loki rar

cocaman

Malicious email (T1566.001)
From: "DHL Express <dhl@d28.fxoxin.sbs>" (likely spoofed)
Received: "from hp0.d28.fxoxin.sbs (unknown [137.184.20.115]) "
Date: "Fri, 13 May 2022 01:00:59 -0700"
Subject: "DHL Shipment Notification: AWB811470484778"
Attachment: "DHL Receipt_AWB811470484778.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

193

Origin country :

n/a

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

control.exe obfuscated packed replace.exe wacatac

Link:

https://www.filescan.io/uploads/627dfb63ce11c3e7ab090e7b/reports/41ce10bb-4976-48da-9b2b-c83eec28d94f/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/44ff3239ff43648e6a0bdd377505fad2f5f3d03e7a4abf475fa4db047de10675/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-05-13 04:09:08 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 26 (73.08%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=it7teop7insi42ql3u3xkbp22l27hub6pjfl6r27utnqi7pbaz2q._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220513-g92l5scgg7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://198.187.30.47/p.php?id=19957150644816880
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/44ff3239ff43648e6a0bdd377505fad2f5f3d03e7a4abf475fa4db047de10675