MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 555b2972f95ebe5f22482a33aa3300d06f1a1748ad6b46172efe1e90cff37e7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	555b2972f95ebe5f22482a33aa3300d06f1a1748ad6b46172efe1e90cff37e7e
SHA3-384 hash:	eb196c00ffc231df2a166b52c2544733a2d57ba5e70ab9023f6f32b3d5e57f06b9326694c0e8d4120febf0c76c990986
SHA1 hash:	70a70ec69361989666b49cce7b76bfd4a8dba407
MD5 hash:	3329b3a901a1e69844749c0c48126b01
humanhash:	beer-edward-rugby-illinois
File name:	ESO9008H743224.CAB
Download:	download sample
Signature	Loki Create hunting rule
File size:	278'151 bytes
First seen:	2022-01-18 08:05:42 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:ALrVuyNSphktIPu/PbMp/j3rIRG5qNFh6cLmOwKy/QgE0pY/8:srQaOhkSUPbMtcRGCZQ/QgJpx
TLSH	T10844239B4E8513667EA27A359970D8983FE73B071CA34D4B39CEA5F2CC840D49E7291C
Reporter	cocaman
Tags:	cab Loki rar

cocaman

Malicious email (T1566.001)
From: "FX Online: International Money Transfer <jem.phi@batmobilestate.com>" (likely spoofed)
Received: "from batmobilestate.com (unknown [45.137.22.85]) "
Date: "18 Jan 2022 08:14:07 +0100"
Subject: "Proof of Payment Reference #TT34KDSS"
Attachment: "ESO9008H743224.CAB"

Intelligence

File Origin

# of uploads :

# of downloads :

206

Origin country :

n/a

Vendor Threat Intelligence

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/61e674efd32385db63006dc8/reports/54c483e5-a099-4011-a285-f84496406138/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/555b2972f95ebe5f22482a33aa3300d06f1a1748ad6b46172efe1e90cff37e7e/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-01-18 08:06:09 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 27 (66.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kvnss4xzl27f6isifiz2umya2bxruf2ivvvumfzo7ypjbt7tpz7a._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/220118-jze2haabh8/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://aboasu.xyz/me/uus/zipx.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/555b2972f95ebe5f22482a33aa3300d06f1a1748ad6b46172efe1e90cff37e7e