MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d
SHA3-384 hash:	7d46f6830546db81efdd5103a16a209d6f21786fdfe8c0776ee76840c38cd60b9973ecfb2ef64260ecf144e26f8f679e
SHA1 hash:	f6fe29f3e7830b15e3b244ba83216c029dcb60fb
MD5 hash:	0b1aa8ae190d05df71f4052fae67df5b
humanhash:	five-delta-sixteen-uranus
File name:	seethebestthingstobegoodwithhislifebestthigns.hta
Download:	download sample
Signature	Loki Alert Create hunting rule
File size:	133'636 bytes
First seen:	2024-10-25 08:31:35 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	96:Eam7QSo4DH5wo4DH5rtTRJP4srvjTKP4DH5Sr4DH5NFAb5UAf4DH5G7T:Ea2Rok0RLknYoVT
Threatray	4'424 similar samples on MalwareBazaar
TLSH	T1F7D3A089EA3188ECB7DC0EA7BDFE739D3959575FA3561E91930B3641CC6434D508042E
Magika	txt
Reporter	abuse_ch
Tags:	hta Loki

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

95

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Obfus-95.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=671b5788c3dc4efa539aaf59

Tags:

Powershell Phishing Gumen

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d/results/dashboard

Payload URLs

URL

File name

http://192.3.176.141/36/goodthingswithgreatcomebackwithgreatthigns.tIF

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

phishing

Link:

https://www.filescan.io/uploads/671b5786696ddb5518cf7626/reports/bf1e6643-22d1-41d0-9361-c0d9823e9f5b/overview

Hybrid Analysis VBS.Asthma.2.A30EFD8E

Verdict:

Malicious

Labled as:

VBS.Asthma.2.A30EFD8E

Link:

https://www.hybrid-analysis.com/sample/4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d

Joe Sandbox Cobalt Strike

Result

Threat name:

Cobalt Strike

Alert

Create hunting rule

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1541928

Signature

AI detected suspicious sample

Bypasses PowerShell execution policy

Detected Cobalt Strike Beacon

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Obfuscated command line found

PowerShell case anomaly found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d/

ReversingLabs TitaniumCloud Script-WScript.Phishing.Asthma

Threat name:

Script-WScript.Phishing.Asthma

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-10-24 12:35:07 UTC

File Type:

Text

AV detection:

13 of 38 (34.21%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jyk6vmmaoexzt37f52twbpxkiwghx7co5npvsynswximtn3bdu6q._file

Threatray lokipasswordstealer(pws) lokibot

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Alert

Create hunting rule

lokibot

Alert

Create hunting rule

Similar samples:

04f557582bc8b4c4af843d0c837124da73f887ac5b997efdd78f96d45caced85

Loki

0af4bdeb4de3a9f8cac5601c872cd4d9a7e9fb06a4fc0a7ed4fb60d6cb64b957

Loki

0dc69e491c783527c6465e25b8b33447391ae9d7ace6e4c1c20db8047aa1918a

Loki

0f6a0c8f4c9d3fa419bd22b2687328e7a721ad0b1ef504a64166b1c630997cee

Loki

16510508a55e331de91a5e246b4d0174a419203d557d7407861bf24a947ce16c

Loki

594a574211cffc47d78817221315092ab978403b71e1ff43922286ec9f60e188

Loki

79866667d5cd578a1c6eda54a748ff9d316fff39064eecd282bc2a9ad8a5ac7d

Loki

7f0fcb4f3651ec6a3b273322857afe8aa8373f77964afd0bb592378a4a97fe1a

Loki

a1f8dd874a1d63dfbd2cc504fbe6d5784eb00610b02fef44b606b7a127f41bc4

Loki

error

Loki

f3797cb6054ef9d5de1b4ecb2745424ef0481c5cb28ec2f2384d2591019e1650

Loki

+ 4'414 additional samples on MalwareBazaar

Hatching Triage lokibot

Result

Malware family:

lokibot

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lokibot collection defense_evasion discovery execution spyware stealer trojan

Link:

https://tria.ge/reports/241025-kfahcaybmj/

Behaviour

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Evasion via Device Credential Deployment

Lokibot

Malware Config

C2 Extraction:

http://94.156.177.220/logs/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Dropper Extraction:

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4e15eab180712f99efe5eea760beea458c7bfc4eeb5f5961b2b5d0c9b7611d3d