MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 453b2c84056cde325f4e314ecb272996714901ced897e8605658d25f1036aee6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 16

Intelligence 16 IOCs YARA 17 File information Comments

SHA256 hash:	453b2c84056cde325f4e314ecb272996714901ced897e8605658d25f1036aee6
SHA3-384 hash:	a6b4afb1493970529b291a908023387ebe9f2058129795395ab2176c6de6925d304176d7b80674d4d16facd57bf6bf6a
SHA1 hash:	443e4b9fac3d7307c7812c28b87af3e752c5523f
MD5 hash:	e2589e81e13ff990793d27d610ba48ce
humanhash:	georgia-eleven-december-victor
File name:	FedEx Express _771706182561.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	452'608 bytes
First seen:	2023-04-14 06:04:05 UTC
Last seen:	2023-04-14 17:12:59 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:dsMKIgZiiIeNd+mMhJFtBILciwoO9X4QOeAjz9GF:qIgAO+LnBILcQO9/OeOG
Threatray	4'195 similar samples on MalwareBazaar
TLSH	T1D7A41222B2E45F27C0BD52F216B095184372A8139871D2DE4DCE64FE2AE77C15E62F93
TrID	63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	0000c4c4e4c47000 (17 x AgentTesla, 7 x SnakeKeylogger, 6 x Loki)
Reporter	abuse_ch
Tags:	exe FedEx Loki

Intelligence

File Origin

# of uploads :

# of downloads :

224

Origin country :

Vendor Threat Intelligence

Malware family:

lokibot

ID:

File name:

FedEx Express _771706182561.exe

Verdict:

Malicious activity

Analysis date:

2023-04-14 06:08:07 UTC

Tags:

trojan lokibot

Link:

https://app.any.run/tasks/2899215b-061a-4ef0-8810-f9457fdbc443

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

LokiBot

Link:

https://www.capesandbox.com/analysis/382149/

Detection(s):

Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL

Win.Trojan.EmbeddedDotNetBinary-9940868-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

floxif lokibot packed remcos threat virus

Link:

https://www.filescan.io/uploads/6438ed0fb7679e422cf78be2/reports/1b608004-fe32-40db-bc2e-4e44c4d7b832/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/453b2c84056cde325f4e314ecb272996714901ced897e8605658d25f1036aee6

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3dca362c-d95c-4de2-adcc-e85bc9199d5d

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1213657

Signature

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/453b2c84056cde325f4e314ecb272996714901ced897e8605658d25f1036aee6/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2023-04-13 02:33:34 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=iu5szbafntpdex2ogfhmwjzjszyusaoo3cl6qycwldjf6ebwv3ta._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/230414-gs66asaa2w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://64.227.48.212/?page_id=6303
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

30780f2a50e90cd2774acd886918d8d92ea624a05b12d0e1faf7cec64a426edd

MD5 hash:

8d4982d22e42360c6097abdcf0ed79dd

SHA1 hash:

d7df2a1af071b636182c8f77affb9bcd9dc8c88e

Detections:

lokibot

win_lokipws_auto

win_lokipws_g0

Link:

https://www.unpac.me/results/a1937dee-963d-4a13-9c24-7c07328de8b5/

Parent samples :

93c302b6c6f9186edb01c0192fccec2b77274a243e3eb049ae8c99679f57c9f1
8e8f0ef7fe5176d9ca580c127a9476ca505c4990c317ebd7b18b92129eac4bb2
c013ec7ffc307a96a83494d9c838f60be692507aede1a0b5d7288a3993ccc57b
d8bcf863b8af5d3a0622ab2fe468752219a1e80e85ccb1e7d29608cb49350f46
a4d692bd2c6bc99530e231e63c93ee24629894b4f9391debdafcc0c161ec972d
b3a40483ab494f036bce8494672fcabc9719ac985979446135ca2625de80056d
3a7511034e72aa8874f3763cb01604464c74571237bc08906578ed9dcf2c137f
453b2c84056cde325f4e314ecb272996714901ced897e8605658d25f1036aee6

SH256 hash:

866dc38de1e23aedb807dce784687ab525d9af0ef37b74f42aa4a4a9855ac8a4

MD5 hash:

776827583b7bd7d73a23bc98ed42cce3

SHA1 hash:

cb42937664496a96d80ff5ef41eff921f6050039

Link:

https://www.unpac.me/results/a1937dee-963d-4a13-9c24-7c07328de8b5/

SH256 hash:

9247839530c40b0028dadad162a054bddcaa8abbc4001cf542d075edeb12a8bd

MD5 hash:

1f3351b45be884bd60bc60ae6b040c32

SHA1 hash:

ab4f0574ff48f3485e778410fda1cc454c147dce

Link:

https://www.unpac.me/results/a1937dee-963d-4a13-9c24-7c07328de8b5/

SH256 hash:

beca703fc4c646b34f1da8d0f8f61eb9efc1297f18a4e9c2db94d7a4d5f8ecbc

MD5 hash:

e1be4f4e6549debbcc9b97bd396beb5c

SHA1 hash:

a983708cebc5f995fb7446e6a63df143bbe95e6d

Link:

https://www.unpac.me/results/a1937dee-963d-4a13-9c24-7c07328de8b5/

SH256 hash:

40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403

MD5 hash:

c768bac25fc6f0551a11310e7caba8d5

SHA1 hash:

95f9195e959fb48277c95d1dd1c97a4edff7cb3a

Link:

https://www.unpac.me/results/a1937dee-963d-4a13-9c24-7c07328de8b5/

SH256 hash:

453b2c84056cde325f4e314ecb272996714901ced897e8605658d25f1036aee6

MD5 hash:

e2589e81e13ff990793d27d610ba48ce

SHA1 hash:

443e4b9fac3d7307c7812c28b87af3e752c5523f

Link:

https://www.unpac.me/results/a1937dee-963d-4a13-9c24-7c07328de8b5/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/453b2c84056c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Dotnet_Hidden_Executables_Detect Create hunting rule
Author:	Mehmet Ali Kerimoglu (@CYB3RMX)
Description:	This rule detects hidden PE file presence.
Reference:	https://github.com/CYB3RMX/Qu1cksc0pe

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	LokiBot Create hunting rule
Author:	kevoreilly
Description:	LokiBot Payload

Rule name:	malware_Lokibot_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	SUSP_Reverse_DOS_header Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects an reversed DOS header

Rule name:	Windows_Trojan_Lokibot_0f421617 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Lokibot_1f885282 Create hunting rule
Author:	Elastic Security

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

exe 453b2c84056cde325f4e314ecb272996714901ced897e8605658d25f1036aee6

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/382149/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample