MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e5daccda1624bc3412f03c4876f1254f57fe07fcbfe730e5a25b4c50a29c34f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 15

Intelligence 15 IOCs YARA File information Comments

SHA256 hash:	4e5daccda1624bc3412f03c4876f1254f57fe07fcbfe730e5a25b4c50a29c34f
SHA3-384 hash:	7ce550878c2a1d94f20330a20521de19ad663eeb0bc374ddc7a3937dc4f6fd973c672e67bf53312c63c4c7b86adac0c3
SHA1 hash:	e9cb919dc13a963c06093b4eccc5903b6af5fb31
MD5 hash:	b15fd3f793bd097c47a5532f699088df
humanhash:	echo-april-high-october
File name:	b15fd3f793bd097c47a5532f699088df.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	260'640 bytes
First seen:	2021-10-11 18:40:20 UTC
Last seen:	2021-10-11 20:17:36 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep	6144:F8LxBs/NEUKEow3qPsIpbtmY2nKe4ib3KhAZbcVJc:/iUKEf3qPpH+3eGR
TLSH	T18744121226D190F7CCC11E315A3AB77AFBBEC91412215A4B0FD81F775A7308BE46A3A5
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	abuse_ch
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

296

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

b15fd3f793bd097c47a5532f699088df.exe

Verdict:

Malicious activity

Analysis date:

2021-10-11 19:13:26 UTC

Tags:

trojan lokibot stealer

Link:

https://app.any.run/tasks/1bb77025-4519-4418-953d-47f55685f3d5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/196713/

Detection(s):

SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.22901.7050.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file

Creating a window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/616485411c2d58ba74021d64/reports/05ecc4a8-c088-4b7e-94b9-3f70c6364242/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0ba872a8-0c0b-4f11-9664-34ac30a495e4

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/867827

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/4e5daccda1624bc3412f03c4876f1254f57fe07fcbfe730e5a25b4c50a29c34f/

Threat name:

Win32.Trojan.Nsisx

Status:

Malicious

First seen:

2021-10-11 18:41:06 UTC

AV detection:

12 of 44 (27.27%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jzo2ztnbmjf4gqjpapcio3yskt2x7yd7zp7hgds2ew2mkcrjynhq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/211011-xbrmaahhc9/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Loads dropped DLL

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://136.243.159.53/~element/page.php?id=488
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php