MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4db05906c2a8880173346797058cf9106d0e741390696eacaf04ef868e9163ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	4db05906c2a8880173346797058cf9106d0e741390696eacaf04ef868e9163ac
SHA3-384 hash:	7dbb5cbdff6869e83fe89bda21a98ee84852fa1f0bfb34b47759d302635a380a539929c6f5913460b051f9ea158f3185
SHA1 hash:	84fb5a731fa11f5004ba678caee6c2cea801e744
MD5 hash:	3bbf87c9c628c5a28f31d756187bdf91
humanhash:	failed-sweet-enemy-batman
File name:	New Quotation.rar
Download:	download sample
Signature	Loki Create hunting rule
File size:	633'899 bytes
First seen:	2022-02-17 07:31:47 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:wXj9ZOxhBKV4TGB/t3v93FVPYXqK2uiQCiRWwq1IVv/HL0KnezqsC48:wXj9wozf93FCPvl1rkzqsCf
TLSH	T19DD433BD68062605C469A18E76D70D2C06667F6C8DB30D6F83066CCCF5E3F1C2B6AD69
Reporter	cocaman
Tags:	Loki rar

cocaman

Malicious email (T1566.001)
From: "HENRY JOHN <henry@cmnvpo.sbs>" (likely spoofed)
Received: "from hp0.cmnvpo.sbs (unknown [64.225.63.0]) "
Date: "Wed, 16 Feb 2022 18:07:01 -0800"
Subject: "REQUEST FOR QUOTE : OUR REF. NO. HAK/21451/2022"
Attachment: "New Quotation.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

228

Origin country :

n/a

Vendor Threat Intelligence

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

greyware obfuscated packed remote.exe replace.exe

Link:

https://www.filescan.io/uploads/620df9fba2660f3bb9ee5428/reports/2692e078-8303-4afa-a29c-c16e52302c94/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4db05906c2a8880173346797058cf9106d0e741390696eacaf04ef868e9163ac/

Threat name:

ByteCode-MSIL.Backdoor.Androm

Status:

Malicious

First seen:

2022-02-17 06:35:01 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

7 of 42 (16.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jwyfsbwcvceac4zum6lqldhzcbwq45atsbuw5lfpatxyndurmowa._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/220217-jc1dxsafc6/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://164.90.194.235/?id=13524038937789651
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/4db05906c2a8880173346797058cf9106d0e741390696eacaf04ef868e9163ac