MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5bab810143763ff74197839ad14aea2ccf9f7b4fde5c69a380bb5e6222e3af91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 5

Intelligence 5 IOCs YARA File information Comments

SHA256 hash:	5bab810143763ff74197839ad14aea2ccf9f7b4fde5c69a380bb5e6222e3af91
SHA3-384 hash:	dec2ec6f1ddaf00b1c2e67a02481697865f7d766c4086be4fdef9c90763467cd12d9503f2802838e0cfaf39c68270aaa
SHA1 hash:	6ba1417fab4cad9aa219e99ef241b9aee36e2e1c
MD5 hash:	6b5cb5cee2de1a1b2e4f5630998cf1fe
humanhash:	mississippi-montana-connecticut-wisconsin
File name:	17603.rar
Download:	download sample
Signature	Loki Create hunting rule
File size:	64'219 bytes
First seen:	2022-07-11 10:13:17 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	1536:GXdxjoNqmMP3ayp9/xVMAz9gPyLpcoFqT0jJI/lmtz8:Kdxjogqyp/yAzG6Fa0VO
TLSH	T1CA531210F1C9CFC1E4B6ECEF374D879C581E254D239E38DBB4A74850C8AA2137A9D189
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	Loki rar RFQ

cocaman

Malicious email (T1566.001)
From: "Elino Gertes <elino@shariq.net>" (likely spoofed)
Received: "from morinfys.clubsatlanta.com (morinfys.clubsatlanta.com [45.130.138.252]) "
Date: "Mon, 11 Jul 2022 09:49:25 +0800"
Subject: "RFQ # 17602 & 17603"
Attachment: "17603.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

171

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5bab810143763ff74197839ad14aea2ccf9f7b4fde5c69a380bb5e6222e3af91/

Threat name:

ByteCode-MSIL.Downloader.PsDownload

Status:

Malicious

First seen:

2022-07-11 05:42:32 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 41 (41.46%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lovycakdoy77oqmxqonncsxkfthz662p3zogti4axnpgeixdv6iq._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection persistence spyware stealer suricata trojan

Link:

https://tria.ge/reports/220711-l9mv7saec6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Checks computer location settings

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Fake 404 Response

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://sempersim.su/gi12/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/5bab810143763ff74197839ad14aea2ccf9f7b4fde5c69a380bb5e6222e3af91