MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59fc08579d994f0e101bdb910eaf28ef9588712cd7695e768a5e328b73c5d136. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 15


Intelligence 15 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59fc08579d994f0e101bdb910eaf28ef9588712cd7695e768a5e328b73c5d136
SHA3-384 hash: 9092f93ef92c6af986b999d2d17fb141dc32b4927d99529aafd26ab9af88fb062384c7d4c31d4519473aa51660d5afe5
SHA1 hash: c5104418b5fa916771330263c6ad48120ddbe51c
MD5 hash: 205d2814030df2d949daf1b4e0d2d08c
humanhash: salami-coffee-summer-eighteen
File name:PO210091601TTRCOPYpdf.exe
Download: download sample
Signature Loki
Create hunting rule
File size:839'680 bytes
First seen:2022-09-02 06:45:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:F7kysQrnwHSHe+IYPMBfOHMDcc5IF5q+1v5m8rQ1K60UFSElOyGmDPgnFGiWW5m:FVrna1WsDcWInl5mKVElAmDsFPp
TLSH T1BE05128B33AC4717D47F93F5AC1618984BB16B0A6AD1C7EC0CA124EF0EB4B45495B72B
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0c4ccdcdce8f0f0 (6 x Formbook, 6 x AgentTesla, 2 x NanoCore)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://sempersim.su/gj23/fre.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://sempersim.su/gj23/fre.php https://threatfox.abuse.ch/ioc/847339/

Intelligence

File Origin
# of uploads :
1
# of downloads :
377
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
PO210091601TTRCOPYpdf.exe
Verdict:
Malicious activity
Analysis date:
2022-09-02 06:47:18 UTC
Tags:
trojan lokibot stealer
Link:
https://app.any.run/tasks/ce430b50-8ce0-4b70-ae44-0bfad7859ca2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/307352/
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.91310.26149.16869.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Reading critical registry keys
Enabling the 'hidden' option for analyzed file
Stealing user critical data
Moving of the original file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm packed
Link:
https://www.filescan.io/uploads/6311a6f2e87b88e71bedd82f/reports/77254932-18d3-4b8a-bd17-8f760d20a8ca/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c6a8c523-ae45-4b91-9854-35c5cc1ff5fc
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1063756
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/59fc08579d994f0e101bdb910eaf28ef9588712cd7695e768a5e328b73c5d136/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-09-02 06:46:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
21 of 25 (84.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lh6aqv45tfhq4ea33oiq5lzi56kyq4jm25uv45uklyziw46f2e3a._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/220902-hjmkzacae4/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://sempersim.su/gj23/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
fd6c15bd7ae7c44d9a20bcd0629701e8909ed9abcd440eb0ef7ecfae3121142f
MD5 hash:
73fe96a99c1b0f739b3beefa857b09aa
SHA1 hash:
f7327b0dd78852d54a1a930ba00e082d72eda715
Link:
https://www.unpac.me/results/ecdb19cf-e9f9-4827-80b7-dc0bbde0fddd/
SH256 hash:
7ab1e055ec731f3bf02dd5c25d61b53dc301069fb3bf4e91ec66df26633ebe33
MD5 hash:
341a78d07a0bff392c7b85a519eb8bf1
SHA1 hash:
b30a7f5104581453a265a0378a825c7e4478705b
Detections:
lokibot
Create hunting rule
Link:
https://www.unpac.me/results/ecdb19cf-e9f9-4827-80b7-dc0bbde0fddd/
SH256 hash:
409ae13fe5b99f7594aaf0d85821eb7a68093bdd9bd4fdd47dd8c5de8e733f85
MD5 hash:
4463eb52a060c079e745d9c621d9c3a0
SHA1 hash:
927c3a4399488f03569c1eafbb4b5bc34f071daf
Link:
https://www.unpac.me/results/ecdb19cf-e9f9-4827-80b7-dc0bbde0fddd/
SH256 hash:
285a8f9243336c4baf4f748f2104dcf18296f1e71bf234f9fa738688eb5b26bc
MD5 hash:
276003263f8f970f6d0e4031f177d0a9
SHA1 hash:
06968c989c7e1e38fa412eec0366fbcae98e5bd9
Link:
https://www.unpac.me/results/ecdb19cf-e9f9-4827-80b7-dc0bbde0fddd/
SH256 hash:
a7dd98ff8f0868e48cdb1775e869c02c028aa10545588e0d4bd9802696c42f78
MD5 hash:
c4052971f578b8998e423f41c264b663
SHA1 hash:
00a97bbab9dd2c6526f44a1dc89df07e6671dbee
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
lokibot
Create hunting rule
Link:
https://www.unpac.me/results/ecdb19cf-e9f9-4827-80b7-dc0bbde0fddd/
Parent samples :
59fc08579d994f0e101bdb910eaf28ef9588712cd7695e768a5e328b73c5d136
42c537a9924326645929da0445d5b2770398fc4f1fd6a3c8344ebb485fb00c37
7f600ed3a66941131c5691180fa4f0d251c7f93f2a2cef100c34c17ca468aba8
2566c8b7a7a73671cc185388a519d68b795b82b1a7bcd69c5cbeefe1aa0a3fea
acdc4a62f577a0392697bb667404f57acd1e265fc3029038d664b8810c121c70
7e44c6fb6963620960fe0f8574af42ec032aaff7238bf470cba2c4af3a9da77d
23c2bb16fef046c904d5cb83471792c20860286f23ff19b5e82cad0e35cf7595
1ff1d5a4141701b4e7fb203e2fae16d262a1a5a7f66dcf75597ca9bec9d69211
40fa8080a15867bab525b6ddf103df5e628d552003284c25dc8e4a34d6fbc6e8
37d1a5c9f0c9aed320a5335226b073bb5e81e322a6446c29f96b2f7a3a7f529f
SH256 hash:
59fc08579d994f0e101bdb910eaf28ef9588712cd7695e768a5e328b73c5d136
MD5 hash:
205d2814030df2d949daf1b4e0d2d08c
SHA1 hash:
c5104418b5fa916771330263c6ad48120ddbe51c
Link:
https://www.unpac.me/results/ecdb19cf-e9f9-4827-80b7-dc0bbde0fddd/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/59fc08579d99/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/59fc08579d994f0e101bdb910eaf28ef9588712cd7695e768a5e328b73c5d136

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/307352/

Comments