MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 497f1767839d62e5bba3a33a89841eb2fcd196bd743014b6c5ede55d6a3eecd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 15


Intelligence 15 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 497f1767839d62e5bba3a33a89841eb2fcd196bd743014b6c5ede55d6a3eecd3
SHA3-384 hash: 83cd4067aad38b7f7bb22c7ff359ee8075c7fd5aa0595de6921ff9cff9f34b3fe8adfa16148a8aba92a28d28e1154b5e
SHA1 hash: 87ab87da830486ef0135d20b569fd9edc2a0e6d1
MD5 hash: b6fce55e8bd0ae825447eecc5a191f1e
humanhash: three-cardinal-timing-xray
File name:TNT NOTIFICATION213596003.exe
Download: download sample
Signature Loki
Create hunting rule
File size:489'984 bytes
First seen:2023-04-24 02:20:10 UTC
Last seen:2023-05-13 22:58:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'472 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:q3vaOpCOLFPMpqgTzygvs/tW0A8M9PeQi:q3vppC8F0pXT0W0S9P7i
Threatray 4'312 similar samples on MalwareBazaar
TLSH T16CA4025A0177BAEADDCC5BBB052824464731A0E35129EB2C9BE40D8ECE43B47FF4546B
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon e4e22964caece4e8 (8 x AgentTesla, 3 x Formbook, 2 x Loki)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://104.156.227.195/~blog/?p=27007499821

Intelligence

File Origin
# of uploads :
2
# of downloads :
351
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
TNT NOTIFICATION213596003.exe
Verdict:
Malicious activity
Analysis date:
2023-04-24 02:21:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/de2cfed3-8a75-4211-9ca6-97403b858f73

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/384352/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Enabling the 'hidden' option for analyzed file
Moving of the original file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6445e78f5ff821708a440459/reports/544c3af2-12a9-44f8-8a23-5d9e959fa190/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/497f1767839d62e5bba3a33a89841eb2fcd196bd743014b6c5ede55d6a3eecd3
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0f8c4bab-1a66-4fdf-b37e-b5109657e683
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1219622
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/497f1767839d62e5bba3a33a89841eb2fcd196bd743014b6c5ede55d6a3eecd3/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-04-24 02:21:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jf7roz4dtvrolo5dum5itba6wl6ndfv5oqybjnwf5xsv22r65tjq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
0699e889c84a872eccddfa07916b7a7e379ce6335e1796d67d119b6450323790
Loki
1aa1a9e5b07f7e5a5d4cfb16aaadd4a68e2bd76c42f96e932396ccc8d5f18785
Loki
3a7511034e72aa8874f3763cb01604464c74571237bc08906578ed9dcf2c137f
Loki
416d574131255e4656d9d548ef7c74c1ba3850aa80a9acd9dbd0352eb03053ee
Loki
5a9397f2ec2a6609708ad1bbbff41e1d6d099d863d0714003d35070be9786edd
Loki
74c836dfe668140a6936e71347ac8eafd517ec914d7201666081f99c2a6ae846
Loki
7a8d290bf6d1b3569c07e682b03577896711f694c165b227bcf9e4510060a993
Loki
82faa2430877999d6998765647feeb8a474a5672736637d8278efa9e2425ca83
Loki
d54151c230934c4d85c69c1b0e9f8dacd60104fde0d2036a7752f49293d25c5b
Loki
f79a80b0ff4dd1066e5c4844882278b420c591a05c73838a1c69190f0d145826
Loki
+ 4'302 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/230424-cszzrsah6w/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://104.156.227.195/~blog/?p=27007499821
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
dee0466ac8bd8e3cc3790dc6a02319bbd7d55c7e1d73131eb9193dfe4ce978b5
MD5 hash:
1e61db6deb6335d137eed11acb9cab05
SHA1 hash:
fb6f43c46fd80b5231e08f49d18d26597316ac9a
Link:
https://www.unpac.me/results/c81ef9f7-04e0-4aa1-b7e9-72208974bbb5/
SH256 hash:
bcb0712f7ce3fc39215bdd3af15404022cd58c0dd5ccb827590b8f34c9accacc
MD5 hash:
29561dfe6a23568553f23966d1fcaa51
SHA1 hash:
f491a46e836c1a6887852334af4c6e89280493af
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
Link:
https://www.unpac.me/results/c81ef9f7-04e0-4aa1-b7e9-72208974bbb5/
Parent samples :
497f1767839d62e5bba3a33a89841eb2fcd196bd743014b6c5ede55d6a3eecd3
bcb0712f7ce3fc39215bdd3af15404022cd58c0dd5ccb827590b8f34c9accacc
6ac14b0f832c5a9e01ff317b9620b2f88e240ceaf8de3b507f093e789098c535
SH256 hash:
40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403
MD5 hash:
c768bac25fc6f0551a11310e7caba8d5
SHA1 hash:
95f9195e959fb48277c95d1dd1c97a4edff7cb3a
Link:
https://www.unpac.me/results/c81ef9f7-04e0-4aa1-b7e9-72208974bbb5/
SH256 hash:
88096131c3dd4004c8a7580b4f6bb9bcb6a81342e7712dc83ae538e8bde5614f
MD5 hash:
1bc6ecbe0da97289a3c360dbd1917046
SHA1 hash:
4fde8703729b1d31bd7258dcabffc0e8ce2055c1
Link:
https://www.unpac.me/results/c81ef9f7-04e0-4aa1-b7e9-72208974bbb5/
SH256 hash:
f177fb1785a3b102315778cb1d52be06ad817dcc598f74536264049369249da9
MD5 hash:
df67dd5548a6acd968bd7e46300ef6c0
SHA1 hash:
09bb2d227c9cbd9d1243d2e20a03c8c664d759c5
Link:
https://www.unpac.me/results/c81ef9f7-04e0-4aa1-b7e9-72208974bbb5/
SH256 hash:
497f1767839d62e5bba3a33a89841eb2fcd196bd743014b6c5ede55d6a3eecd3
MD5 hash:
b6fce55e8bd0ae825447eecc5a191f1e
SHA1 hash:
87ab87da830486ef0135d20b569fd9edc2a0e6d1
Link:
https://www.unpac.me/results/c81ef9f7-04e0-4aa1-b7e9-72208974bbb5/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/497f1767839d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/497f1767839d62e5bba3a33a89841eb2fcd196bd743014b6c5ede55d6a3eecd3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:LokiBot
Create hunting rule
Author:kevoreilly
Description:LokiBot Payload
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:Windows_Trojan_Lokibot_0f421617
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Lokibot_1f885282
Create hunting rule
Author:Elastic Security
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/384352/

Comments