MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ec2fd690c7b8eca3ef9a7a2624672f7ef09f75985922656ab588062ec1212ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ec2fd690c7b8eca3ef9a7a2624672f7ef09f75985922656ab588062ec1212ed
SHA3-384 hash: f4f693eea79bfce2e9fdd3091dbc2f9ea9847b6e2fca1683b8260de40a8004653cdb649a12d1faa3e1a7a8b7e6aec06b
SHA1 hash: eced4f9dd7e9dea0d6836753cc55042dac7b9aab
MD5 hash: f8907e4492367a471d4883b2bb07c2ce
humanhash: comet-india-dakota-bacon
File name:Shipwrightry217.exe
Download: download sample
Signature Loki
Create hunting rule
File size:567'315 bytes
First seen:2023-03-22 09:11:50 UTC
Last seen:2023-03-30 09:29:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a592076b17ef8bfb48b7e03965a3fc (388 x GuLoader, 59 x RemcosRAT, 44 x VIPKeylogger)
ssdeep 12288:cqp+8Qve8l8/bB84fFVubbn8XfG0xTzLSS0/K779NKKc06Kux:48Ue8l86GFIbn8XppF58h06Kux
Threatray 204 similar samples on MalwareBazaar
TLSH T108C423517390E826C4A24F72DD53AA6ADBFF5B1055791A0327383EEFB333B820945729
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter Anonymous
Tags:exe Loki

Intelligence

File Origin
# of uploads :
3
# of downloads :
277
Origin country :
PL PL
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
Shipwrightry217.exe
Verdict:
Malicious activity
Analysis date:
2023-03-22 09:14:52 UTC
Tags:
lokibot trojan
Link:
https://app.any.run/tasks/442b7026-b4c7-40b4-8fe1-00a9cc7994ba

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/376412/
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Creating a file
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Searching for the window
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo guloader overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/641ac664da1bbe29caf979f8/reports/8787a454-635b-40cb-8859-56543b5f168d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/4ec2fd690c7b8eca3ef9a7a2624672f7ef09f75985922656ab588062ec1212ed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/47e1334d-cc6c-4d86-a7eb-beae96595110
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1199180
Signature
Found potential ransomware demand text
Multi AV Scanner detection for submitted file
Obfuscated command line found
Tries to detect Any.run
Very long command line found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 832083 Sample: Shipwrightry217.exe Startdate: 22/03/2023 Architecture: WINDOWS Score: 64 25 Multi AV Scanner detection for submitted file 2->25 27 Found potential ransomware demand text 2->27 7 Shipwrightry217.exe 33 2->7         started        process3 file4 19 C:\Users\user\AppData\Local\...\Agit.Mon21, ASCII 7->19 dropped 21 C:\Users\user\AppData\...21eDSSrcBuilder.dll, PE32 7->21 dropped 23 C:\Users\user\AppData\...23MPluginBase.dll, PE32 7->23 dropped 29 Obfuscated command line found 7->29 11 powershell.exe 14 7->11         started        signatures5 process6 signatures7 31 Very long command line found 11->31 14 powershell.exe 11 11->14         started        17 conhost.exe 11->17         started        process8 signatures9 33 Tries to detect Any.run 14->33
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ec2fd690c7b8eca3ef9a7a2624672f7ef09f75985922656ab588062ec1212ed/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-03-21 09:53:23 UTC
File Type:
PE (Exe)
Extracted files:
99
AV detection:
15 of 37 (40.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j3bp22impohmupxzu6rgerts67xqt52zqwjcmvvllcagf3asclwq._file
Verdict:
malicious
Similar samples:
012cdac9c7fabd82e1be72dcacb79bd73fabdef7bd148f4f1035943e5882270b
Loki
2481fd6c5d237aea74644564492f05998b436ab51fb2730310f4049a53ba5459
Loki
448234787d7924280fedbb49f5702f0483ef8046394f8adc14006f3f8b6793b2
Loki
67012c9555804fbfe82f17ee6d7d09196ed356053e2e778f49a998a4b718d6a6
Loki
691b3c73fa3301b9c36de80df0e7aa9d551a87ccc77a04b93786d6f1f5a41969
Loki
a81759cc686cbbf9946cc49e6bf06907532e57d9ff167e061e3993fb0c0fd1b7
Loki
ab2036dc90a503a003ed28e17ed2cf24001848be05580b6246656f88abe01c86
Loki
dd39027f02b3a47cb2677440f59575089a0673f134cff175d908be574ebc80ac
Loki
dfdedc4060f4944298bcdf25778b7f7eaaef43fdae61238d7debf88825e66294
Loki
efc035ff598957f35768f2d84721bbec76633c60538eda9d5ec53092f4384237
Loki
+ 194 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:lokibot collection downloader spyware stealer trojan
Link:
https://tria.ge/reports/230322-k56xvahh5w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks QEMU agent file
Checks computer location settings
Guloader,Cloudeye
Lokibot
Malware Config
C2 Extraction:
http://185.246.220.85/biggy/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
55840f65725f96acb5b0bf4aafb59474ddec43a65fdd57de65b636330f4bfaa7
MD5 hash:
218bf56661e2f15aa6a64713d46c913a
SHA1 hash:
1eb5ee9d0d54874ffe7dafb492c93c946e117900
Link:
https://www.unpac.me/results/a32a3eaa-f82c-4ed6-9f2d-fd19d4118a6a/
SH256 hash:
096b7802a6261e31a75511bf53a8da322e05c9b8557e5ac8ce87c740facfdb13
MD5 hash:
d4da997fbe92fabd98c998f5ec8983f5
SHA1 hash:
957c707a7353dd60a25cb474ea3df5686b01028e
Link:
https://www.unpac.me/results/a32a3eaa-f82c-4ed6-9f2d-fd19d4118a6a/
SH256 hash:
4ec2fd690c7b8eca3ef9a7a2624672f7ef09f75985922656ab588062ec1212ed
MD5 hash:
f8907e4492367a471d4883b2bb07c2ce
SHA1 hash:
eced4f9dd7e9dea0d6836753cc55042dac7b9aab
Link:
https://www.unpac.me/results/a32a3eaa-f82c-4ed6-9f2d-fd19d4118a6a/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4ec2fd690c7b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/376412/

Comments