MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48822ad616aacef1f830308bd61345af4b091ef4fc15a54725e352ab89bf8d05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48822ad616aacef1f830308bd61345af4b091ef4fc15a54725e352ab89bf8d05
SHA3-384 hash: 1400499af14f3d282d4787293b8afe1998fe651b8b91e372658fee4f2f597dcf19c1d879e34b44e0836a105b6dabadf4
SHA1 hash: 2616545bf22ccf220e742af99477d42317f09cda
MD5 hash: cbe88e0b9eb9d71b969ebcb19d82231e
humanhash: quebec-helium-oklahoma-maine
File name:INVOICE 10076.zip
Download: download sample
Signature Loki
Create hunting rule
File size:258'887 bytes
First seen:2023-02-20 18:02:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:TStQu6TUhqNkDrjLi4y6vAkxl9OpvyHF1w:etQnT0qNofiL6voyHFK
TLSH T133442347491749818AF14D31CE38DDBD9FB0B7BEBA62AB84750C400C4FAF98AD599E06
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:INVOICE Loki zip


Avatar
cocaman
Malicious email (T1566.001)
From: "@mx1.dreamhost.com" (likely spoofed)
Received: "from mx1.dreamhost.com (unknown [193.47.61.37]) "
Date: "20 Feb 2023 01:03:31 -0800"
Subject: "Updated outstanding statement / January 2023"
Attachment: "INVOICE 10076.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:INVOICE 10076.exe
File size:273'683 bytes
SHA256 hash: 27581ab44d1ea9116059d6d244296669e618e9d82b85d3b8fc699401ee244bc8
MD5 hash: bebfe80156455464fd3d296dae2e55b7
MIME type:application/x-dosexec
Signature Loki
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs3181.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Gen.Variant.Nemesis.15914.21189.18233.UNOFFICIAL
Create hunting rule

Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/48822ad616aacef1f830308bd61345af4b091ef4fc15a54725e352ab89bf8d05/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lokibot nemesis overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63f3b5d8e6a5b4588ca11694/reports/dd67a93f-ab06-4bf8-a63c-c99b4d94ccac/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/48822ad616aacef1f830308bd61345af4b091ef4fc15a54725e352ab89bf8d05
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/48822ad616aacef1f830308bd61345af4b091ef4fc15a54725e352ab89bf8d05
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48822ad616aacef1f830308bd61345af4b091ef4fc15a54725e352ab89bf8d05/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2023-02-20 17:18:00 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
15 of 39 (38.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jcbcvvqwvlhpd6bqgcf5me2fv5fqshxu7qk2krzf4njkxcn7rucq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/48822ad616aacef1f830308bd61345af4b091ef4fc15a54725e352ab89bf8d05

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:LokiBot
Create hunting rule
Author:kevoreilly
Description:LokiBot Payload
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:Windows_Trojan_Lokibot_0f421617
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Lokibot_1f885282
Create hunting rule
Author:Elastic Security
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.
Rule name:win_lokipws_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 48822ad616aacef1f830308bd61345af4b091ef4fc15a54725e352ab89bf8d05

(this sample)

Loki

Executable exe 27581ab44d1ea9116059d6d244296669e618e9d82b85d3b8fc699401ee244bc8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 27581ab44d1ea9116059d6d244296669e618e9d82b85d3b8fc699401ee244bc8
  
Dropping
Loki

Comments