MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 591109da111aac82d548d21277af8fe59f6860ec229847cc1571652bddbc957f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 591109da111aac82d548d21277af8fe59f6860ec229847cc1571652bddbc957f
SHA3-384 hash: e925d25b36f728877f63b8b9a5ed3e9f3c767347efb4a587ba36143be29088e6cf681b5a2d09e0bdd7fad249ed9602ef
SHA1 hash: bbcf4a0b125ee1fd45ec76b959efc7d8850d2e0e
MD5 hash: 726e917f393b97f3fc3a5a3f88419fea
humanhash: sad-violet-florida-october
File name:726e917f393b97f3fc3a5a3f88419fea.exe
Download: download sample
Signature Loki
Create hunting rule
File size:340'576 bytes
First seen:2023-05-30 10:18:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b78ecf47c0a3e24a6f4af114e2d1f5de (300 x GuLoader, 23 x Formbook, 21 x RemcosRAT)
ssdeep 6144:7BerKbGqDVAadH6ehiqzxW6HI/GSovOLnOGCrQKduGmUz:saGqDV6XOV9vMOXr5uGmU
Threatray 790 similar samples on MalwareBazaar
TLSH T15774DF112264BC53CD4D9DF6385BE9DC6D674E304ABC527BEEE03A252B31B1FA70A190
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon c0c4f47864647864 (4 x GuLoader, 3 x Loki, 3 x AgentTesla)
Reporter abuse_ch
Tags:exe Loki signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2023-04-01T04:23:38Z
Valid to:2026-03-31T04:23:38Z
Serial number: 574972168352fc8c53b48acd64fa639f1739bca7
Thumbprint Algorithm:SHA256
Thumbprint: 2a46858dd6e3bbbb4c8e520e048d2b5937cf72f508a928c08c68656f568fca76
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
261
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
726e917f393b97f3fc3a5a3f88419fea.exe
Verdict:
Malicious activity
Analysis date:
2023-05-30 10:20:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2495e69e-3e7c-4ead-bc15-bcd076332cfb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/393469/
Detection(s):
SecuriteInfo.com.Mal.Generic-S.31020.16397.20236.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
buer lolbin overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6475cd976407f39ba8add612/reports/6982fab3-8b4c-4416-93e2-a47e06f72e35/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/591109da111aac82d548d21277af8fe59f6860ec229847cc1571652bddbc957f
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/53ed7a96-7106-4ab6-989c-d825f7caebfc
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1245203
Signature
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/591109da111aac82d548d21277af8fe59f6860ec229847cc1571652bddbc957f/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2023-05-30 10:19:05 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=leiqtwqrdkwifvki2ijhpl4p4wpwqyhmekmeptavofssxxn4sv7q._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
cloudeye
Create hunting rule
Similar samples:
07fa172e1404c76738226cefc6e5d45559430c9946e419ed089d9ae5690783f9
Loki
2cb7bc593a5b4701b76d20ba93ad4e2dab62eb3b81dbc9f59965db44dafc97b8
Loki
3588e363e2fdded293586af1c3520ad4ec5fe1d5ba058c0cbf2f89259409cd76
Loki
8a87bbc2669573efdc7db6a99c44ecbcec828ceccc0574ed019309a06c7771f6
Loki
936ef3a90e5433d26c707b0660fb1530a3f717734dc0c86568854c6131f954f7
Loki
98883d7d2678fd8cbdad8b8c1ca7cf13a797b1074f081dee24aba14dcc346ffe
Loki
d5546c4ce65f892b4fc83398f5c45957f03a647c0bcd81488218da710475eae2
Loki
f84353a028d1c96db9ef3c775085e12c5222e3f41f4307f04db938a7b3be9d5d
Loki
+ 780 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:lokibot collection discovery downloader spyware stealer trojan
Link:
https://tria.ge/reports/230530-mchqnahc5x/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks installed software on the system
Checks QEMU agent file
Loads dropped DLL
Reads user/profile data of web browsers
Guloader,Cloudeye
Lokibot
Malware Config
C2 Extraction:
http://194.180.48.58/web/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 hash:
3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 hash:
fe582246792774c2c9dd15639ffa0aca90d6fd0b
Link:
https://www.unpac.me/results/f07453ee-de02-4a47-903f-2ebd83892a8e/
SH256 hash:
591109da111aac82d548d21277af8fe59f6860ec229847cc1571652bddbc957f
MD5 hash:
726e917f393b97f3fc3a5a3f88419fea
SHA1 hash:
bbcf4a0b125ee1fd45ec76b959efc7d8850d2e0e
Link:
https://www.unpac.me/results/f07453ee-de02-4a47-903f-2ebd83892a8e/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/591109da111a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.03
Link:
https://yomi.yoroi.company/submissions/591109da111aac82d548d21277af8fe59f6860ec229847cc1571652bddbc957f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SUSP_NullSoftInst_Combo_Oct20_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious NullSoft Installer combination with common Copyright strings
Reference:https://twitter.com/malwrhunterteam/status/1313023627177193472

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe 591109da111aac82d548d21277af8fe59f6860ec229847cc1571652bddbc957f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2645505/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/393469/

Comments