MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c4dfdbf6ce033bba719e0bc922c364ccd1997d5fce329084e16164416867fa2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	4c4dfdbf6ce033bba719e0bc922c364ccd1997d5fce329084e16164416867fa2
SHA3-384 hash:	52d40f63758f09a2855361bd72fc214f1df867042ead7c9b87f1fea5f074e627784cefaf236de485b21f10b03fc5bfbe
SHA1 hash:	70553f692cc63a68d6e8ae536fb08fa2db4e157b
MD5 hash:	ad4496ae22184db87ffe02c7eb435458
humanhash:	five-chicken-oscar-five
File name:	Purchase Inquiry_pdf.rar
Download:	download sample
Signature	Loki Create hunting rule
File size:	444'672 bytes
First seen:	2022-04-29 09:40:37 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:5ti88CSj0WEdHEnEisK/ga2vy5Ot/44+jElfyz:5tLf20WEdHrVG2G/5Elfyz
TLSH	T1F1942338777C53530FA1E448A0613E95E5B3E9DCBB367126CE20623376855B9283B738
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	Loki rar

cocaman

Malicious email (T1566.001)
From: "Nguyen Thi Quy <nguyen@26.fvmenio.sbs>" (likely spoofed)
Received: "from hp0.26.fvmenio.sbs (hp0.26.fvmenio.sbs [138.68.240.8]) "
Date: "Mon, 25 Apr 2022 01:06:45 -0700"
Subject: "RE: Purchase Inquiry: KPC/PU-231(MECH)NBI/20-22"
Attachment: "Purchase Inquiry_pdf.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

168

Origin country :

n/a

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fareit loki lokibot obfuscated packed replace.exe update.exe

Link:

https://www.filescan.io/uploads/626bb2b22b32b1c37c70d7bb/reports/c3922378-c7f8-4772-855f-8266fe70708b/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4c4dfdbf6ce033bba719e0bc922c364ccd1997d5fce329084e16164416867fa2/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-04-25 03:47:31 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jrg73p3m4az3xjyz4c6jelbwjtgrtf6v7trssccocyleifugp6ra._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220429-lnrl9sedcj/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://198.187.30.47/p.php?id=16819775001048824
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4c4dfdbf6ce033bba719e0bc922c364ccd1997d5fce329084e16164416867fa2