MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47046d5dfe7ecf45e4c31f25b975af78684f9727b91a7d052b5731e95d2f0a4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 9

Intelligence 9 IOCs 1 YARA File information Comments

SHA256 hash:	47046d5dfe7ecf45e4c31f25b975af78684f9727b91a7d052b5731e95d2f0a4c
SHA3-384 hash:	a73ef099b04b267ef0eeba6f76a487f24bee9eab0d2bcb14a916a893d0702e6ed31ae8fe372257524ea5b58ed0881a6e
SHA1 hash:	f0f925827d87f175ea20836e3f1e45a9e9a2a913
MD5 hash:	2185f799306271f52a13cfe6391ead41
humanhash:	lima-apart-four-mockingbird
File name:	REQUEST FOR QUOTE 12-08-2021·pdf.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	155'648 bytes
First seen:	2021-08-12 09:11:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	59e6745bf35b42f470b21adfbf2b29c4 (5 x Loki)
ssdeep	3072:2xEJpxEqxE2wzjo4i4EH5e2nnMCaKACgQrw9xEAxEKxEJ:UEJ7EAE2HAEZfnnUA6EmEgEJ
Threatray	7'699 similar samples on MalwareBazaar
TLSH	T182E39D3337C0852AE286EB7050F112A95F14FC5F884A2A071B56EB5E54F8D33F1EA75A
dhash icon	f8b8b8399993d0f0 (5 x Loki)
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Loki C2:
http://185.227.139.5/sxisodifntose.php/qMLUucoAh0bzK

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://185.227.139.5/sxisodifntose.php/qMLUucoAh0bzK	https://threatfox.abuse.ch/ioc/173616/

Intelligence

File Origin

# of uploads :

# of downloads :

140

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

REQUEST FOR QUOTE 12-08-2021·pdf.exe

Verdict:

No threats detected

Analysis date:

2021-08-12 09:12:57 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/305ef112-c2a6-4aff-a732-900d8775bb6d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.__vbaHresultCheckObj.15357.5028.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Moving a file to the %AppData% subdirectory

Enabling the 'hidden' option for recently created files

Creating a process from a recently created file

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Malware family:

GuLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/90b04b5f-86d9-421b-92df-57125f8aa0ab

Result

Threat name:

GuLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/831607

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

GuLoader behavior detected

Hides threads from debuggers

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/47046d5dfe7ecf45e4c31f25b975af78684f9727b91a7d052b5731e95d2f0a4c/

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=i4cg2xp6p3hulzgdd4s3s5nppbue7fzhxenh2bjlk4y6sxjpbjga._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:guloader family:lokibot downloader spyware stealer suricata trojan

Link:

https://tria.ge/reports/210812-9z4zmqg1a6/

Behaviour

Modifies system certificate store

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Checks QEMU agent file

Guloader,Cloudeye

Lokibot

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://185.227.139.5/sxisodifntose.php/qMLUucoAh0bzK
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

49b04162c412105ab0857de16713724cbf3234a0b6ba51f3a5286312633f20c3

MD5 hash:

1f1b425190b2fb0396ad2d538b1060ba

SHA1 hash:

413f98641d46fdcabfcaf64f29495667de6282ea

Link:

https://www.unpac.me/results/86922921-4c92-4ef0-9da5-40b96d4b113e/

SH256 hash:

47046d5dfe7ecf45e4c31f25b975af78684f9727b91a7d052b5731e95d2f0a4c

MD5 hash:

2185f799306271f52a13cfe6391ead41

SHA1 hash:

f0f925827d87f175ea20836e3f1e45a9e9a2a913

Link:

https://www.unpac.me/results/86922921-4c92-4ef0-9da5-40b96d4b113e/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/47046d5dfe7e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/47046d5dfe7ecf45e4c31f25b975af78684f9727b91a7d052b5731e95d2f0a4c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample