MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e6d691ce07204deefd9cbcc9c310bbc6c2e89c8361ca09e7ed1da4c01b2ad04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	4e6d691ce07204deefd9cbcc9c310bbc6c2e89c8361ca09e7ed1da4c01b2ad04
SHA3-384 hash:	51adc01b3ce65d01970b5afd321f3937571606188e45eb035c0a5428800938e0423c1ad3409ec1a3cd44693683b50b65
SHA1 hash:	4abc5ce4b9efc69c8d78279bf94b8e237c0614c7
MD5 hash:	ec5dbab7a41c69f9bcb9acc0b09a9429
humanhash:	california-comet-blossom-cat
File name:	CG_INV_202066.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	845'824 bytes
First seen:	2020-07-09 07:55:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e335e0f383b17202864efb975d29d538 (14 x AgentTesla, 6 x Loki, 3 x AZORult)
ssdeep	24576:ukAVCi74LofeHXecQmiDXeO4D/QivpEQR:uiiuo2Oq4XeOO/Qep5
Threatray	1'529 similar samples on MalwareBazaar
TLSH	5C058C22B3904833D0631A3D8D1B6778992ABE522EE8BA4B7FF55C4C5F396403935397
Reporter	abuse_ch
Tags:	Endurance exe Loki

abuse_ch

Malspam distributing Loki:

HELO: 142-4-22-49.unifiedlayer.com
Sending IP: 142.4.22.49
From: Accounts Dept <accounts@confidencegroup.co>
Subject: Payment Schedule
Attachment: CG_INV_202066.iso (contains "CG_INV_202066.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/23556/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Reading critical registry keys

Launching a service

Creating a file

Changing a file

Replacing files

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Stealing user critical data

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/4e6d691ce07204deefd9cbcc9c310bbc6c2e89c8361ca09e7ed1da4c01b2ad04/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2020-07-09 07:57:06 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jzwwshhaoicn536zzpgjymilxrwc5coigyokbht62hneyansvuca._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

spyware trojan stealer family:lokibot

Link:

https://tria.ge/reports/200709-nqtwrkfxfn/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: RenamesItself

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://79.124.8.8/plesk-site-preview/chongelctricals.com/http/79.124.8.8/adamsn/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.