MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e95c73aa926d5ba8380028f4a5c874ce76b249bd2f1d8535abf8b6d5a067cc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 9


Intelligence 9 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e95c73aa926d5ba8380028f4a5c874ce76b249bd2f1d8535abf8b6d5a067cc5
SHA3-384 hash: d702cc0eb919cb7bc0a08ecf30aafe060b8806b2f55882dcb13c883d5afa1430f01b64329258d6efa888ee97c7b7a222
SHA1 hash: d1567f17cf397a79c76c4ac8eae273da7c0ab1fc
MD5 hash: c8b7a4268eb8c093f4d8e855be7e7480
humanhash: single-georgia-nine-undress
File name:SM-12284.exe
Download: download sample
Signature Loki
Create hunting rule
File size:349'696 bytes
First seen:2020-10-23 06:59:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'655 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 6144:V+5LGM4cDvQ/ts9gCGBo2XN1gXCZjtZSSzMxessTujuKTu:4wM4WQ/c2VVMwssm
Threatray 346 similar samples on MalwareBazaar
TLSH 2074D0B27D52596FCAAF0772506A80C0FABA12C73BA1CF0D719F430D0E11A1BAB57657
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: s7.itlinkonline.com
Sending IP: 95.217.94.194
From: Shu Ying Yong <shuying_yong@hotmail.com>
Subject: [MIE] new order SM-12284 (DELIVERY STATUS ?)
Attachment: SM-12284.IMG (contains "SM-12284.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/74959/
Detection(s):
SecuriteInfo.com.FileRepMalware.20504.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a window
Unauthorized injection to a recently created process
Reading critical registry keys
Changing a file
Replacing files
DNS request
Launching the default Windows debugger (dwwin.exe)
Connection attempt
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Stealing user critical data
Moving of the original file
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/507859
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4e95c73aa926d5ba8380028f4a5c874ce76b249bd2f1d8535abf8b6d5a067cc5/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 04:23:53 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j2k4oovje3k3va4aakhuuxehjttwwje32ly5qu22x6fw2wqgptcq._file
Verdict:
unknown
Similar samples:
16a4855bceb4df02e0478cd72972a6e7f144f2278fedb239c2cb696cf6bf7199
Loki
659c836026b1ee353c16584705804815ea357519b446db36822fb40bed5ab320
Loki
824db89a974de2fdd2bab3b28897ebe67bc4efc7cd2dea9245ac4317c35cb909
Loki
83a00cced5b83593db2ff0ce7f23937ba5b836b28969c1a0d481a6e9fbea5f53
Loki
84402b111a9e126f52c2ddff7e8d4ac2730bb4ed39409a83ace0a1ded0b4e982
Loki
91de70857ce9dbf596a67b2abad7552a467fcc2a155d349799261fb8585e6c18
Loki
95ccbdefafb7f4b5e2a505d3681803940a8fa7a5cae06ee56036009b4253c5ac
Loki
b938308e908f642f82eb2cfd683a86fcfb09d525e865810dd5af635cfabd315f
Loki
e2ebeb9d7ac12f7465a44a186f2bc83be704f09a003530f40474bb4546769124
Loki
e7adb9ddc612bc2bbc52cc809b0a7b90c6f28f0b9df4fa767dccdab4d1d91c50
Loki
+ 336 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
spyware trojan stealer family:lokibot
Link:
https://tria.ge/reports/201023-twmhwfenjj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://ad4teg.com/cxs/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
4e95c73aa926d5ba8380028f4a5c874ce76b249bd2f1d8535abf8b6d5a067cc5
MD5 hash:
c8b7a4268eb8c093f4d8e855be7e7480
SHA1 hash:
d1567f17cf397a79c76c4ac8eae273da7c0ab1fc
Link:
https://www.unpac.me/results/83136482-8ac0-476b-bbc5-8780ea324732/
SH256 hash:
d251f33c578b44146aee824a95ff1e1f9a725c8d3e5d03924ce4227338c0c6fb
MD5 hash:
b47e8eafd28086d8b02d9a37787139b6
SHA1 hash:
2b120487d7f2f693d542fbda126491c0a3092ebd
Link:
https://www.unpac.me/results/83136482-8ac0-476b-bbc5-8780ea324732/
SH256 hash:
30140c3bf5874d7d184b15513016f9de1524ae95a5efe9a1cb15bad6d6936d64
MD5 hash:
03847d82611bc6461cbb99ca768828f1
SHA1 hash:
39859a3fd3326520dfd1ed10456bb227933a8871
Link:
https://www.unpac.me/results/83136482-8ac0-476b-bbc5-8780ea324732/
SH256 hash:
77fcc0f2d6b1b6843bf39bb2ec0f94bd74217bfbf3177bbf28d88575a005fd32
MD5 hash:
5a3e106c0bbae17106f63659e43b06b9
SHA1 hash:
81a0129ff2880d9f29cccaced7a68c15f2265816
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/83136482-8ac0-476b-bbc5-8780ea324732/
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Link:
https://www.unpac.me/results/83136482-8ac0-476b-bbc5-8780ea324732/
Parent samples :
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
69e2ae11e1b5cbe120bf02301191a1cf05e87fc09b09d63bd782abbf3615d05d
0b778873c94f6bc89a40294c0e85a38ab82509260cd2a2e8b73d00c5c90e8757
7ddfa6f44a60f4b894321f6977f8121cfb371c3c61ac872c58ba61fd5ee13deb
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4e95c73aa926d5ba8380028f4a5c874ce76b249bd2f1d8535abf8b6d5a067cc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_lokipws_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

img 06e625ea6689a30f2287192ac1126bdc69ba58a5a1bc0cbf29cd90a69791b6fa

Loki

Executable exe 4e95c73aa926d5ba8380028f4a5c874ce76b249bd2f1d8535abf8b6d5a067cc5

(this sample)

  
Dropped by
MD5 f7c2cb7f34de79e167018c9c7cecd5c3
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 06e625ea6689a30f2287192ac1126bdc69ba58a5a1bc0cbf29cd90a69791b6fa
Cape
Cape
https://www.capesandbox.com/analysis/74959/

Comments