MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49308a9e13aeae4e41e0b4172007b0de69be4bc7ab43bdaf630a275aae9d0310. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49308a9e13aeae4e41e0b4172007b0de69be4bc7ab43bdaf630a275aae9d0310
SHA3-384 hash: 18f8685ba4e9c88d5255fedade7c0c1c83ec47c3a67be6e7508eddb1b777ccfb62c64edfa42d9e35cfd1876529fdba34
SHA1 hash: 2a1a7bb6a5a9e000283a458dddb9fe0ae94ca98d
MD5 hash: 4ad16fe60fa5600bf981545f4ce769b3
humanhash: december-football-october-don
File name:Swift Copy_MT103.rar
Download: download sample
Signature Loki
Create hunting rule
File size:611'267 bytes
First seen:2022-04-16 19:54:56 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:7HYvuSA6xO5jdRTX34m6U5AWBV1pTsiHn/njFKzSB/7XK+oHSb:s2CO5dRTX34zWD1ZN/RPBOvSb
TLSH T1AED423D0DA766131477EF01A1879B5BB51A13F81612DD00F58D80E78368EC86EF3AE6E
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:Loki payment rar SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: "John Yhu <john@27.fmrxzi.sbs>" (likely spoofed)
Received: "from hp0.27.fmrxzi.sbs (hp0.27.fmrxzi.sbs [206.189.85.181]) "
Date: "Fri, 15 Apr 2022 06:23:07 -0700"
Subject: "RE: Payment Advice"
Attachment: "Swift Copy_MT103.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
505
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fareit lokibot obfuscated packed
Link:
https://www.filescan.io/uploads/625b1f17ffe27d5119ea9b0a/reports/d241ec06-f63c-4725-8632-0e77d23e9d26/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49308a9e13aeae4e41e0b4172007b0de69be4bc7ab43bdaf630a275aae9d0310/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2022-04-15 05:08:51 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jeyivhqtv2xe4qpawqlsab5q3zu34s6hvnb33l3dbitvvlu5amia._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/220416-ym4lnaagf6/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://164.90.194.235/?id=74851800950851794
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/49308a9e13aeae4e41e0b4172007b0de69be4bc7ab43bdaf630a275aae9d0310

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar 49308a9e13aeae4e41e0b4172007b0de69be4bc7ab43bdaf630a275aae9d0310

(this sample)

Loki

Executable exe 256437833ed8f7b619648530a3248a3435d17dd43a98c29d02e96b56083ddc58

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 256437833ed8f7b619648530a3248a3435d17dd43a98c29d02e96b56083ddc58
  
Dropping
Loki

Comments