MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ca60d155deba60b7fd13ffa3498797e4f8c7e4a09d3eb35ccd2c1b15fd7dfb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ca60d155deba60b7fd13ffa3498797e4f8c7e4a09d3eb35ccd2c1b15fd7dfb7
SHA3-384 hash: ad1b80fb58380120a3851b6dfd7f07a374bb4686ca10901b9b17d8e58bae9f93886aea7480a32214fd12d139e42e6769
SHA1 hash: 48029f8d45453e5538623c18643c1b2c646f683a
MD5 hash: a68b33523defb37c81df8bb6e66ba03d
humanhash: wolfram-saturn-whiskey-missouri
File name:FedEx Receipt_AWB#5305323204643.exe
Download: download sample
Signature Loki
Create hunting rule
File size:768'000 bytes
First seen:2022-02-16 14:44:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:hy5pFHJkpe22UeoLiV4FFFWEVzZKsn8S9EvnyrBzu/Wbo70pS:sbBKjzLiklNhy/yrBzuOcQpS
Threatray 6'679 similar samples on MalwareBazaar
TLSH T1A1F40144BB63F549C5790FBAB4A2D0729AE5997C7713EA3B2CD1338C04163F940B4A78
File icon (PE):PE icon
dhash icon 00b271f0f079f2c0 (15 x AgentTesla, 8 x Loki, 4 x Formbook)
Reporter James_inthe_box
Tags:exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/241931/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1197.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Reading critical registry keys
Changing a file
Sending an HTTP POST request
Enabling the 'hidden' option for analyzed file
Stealing user critical data
Moving of the original file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys fareit obfuscated packed
Link:
https://www.filescan.io/uploads/620d0df7ac8ad0468b4739b1/reports/cc6d4fcc-2f5c-4db1-bb15-03358f549744/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8678633c-f3cb-4e1e-94cd-f51140c5979b
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/940888
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5ca60d155deba60b7fd13ffa3498797e4f8c7e4a09d3eb35ccd2c1b15fd7dfb7/
Threat name:
ByteCode-MSIL.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2022-02-16 14:43:29 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lsta2fk55otaw76rh75djgdzpzhyy7skbhj6wnom2la3cx6x363q._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
11d38408d56f6543069290221c53c6db76938ea36cec236bca48d0086e323728
Loki
12f56e0170dd0bd765e935c0709c11a32cf916a9f1f12028e9af123c0a23b8a4
Loki
26767fdadf16f2c90661edc392bd1af5363d613bc03a7998d909c36bd2c04a70
Loki
40d601ecfd028a0952916f77b895d94e6579b154df29c1e2734b84322d2b430b
Loki
7fe467ef6f392039c0ce5edaadf85c19a8406a0b0b7332131e2b2ddc9f074bb6
Loki
a712c93c2e0a8ceeb5c34dc11c10e78416c1f992c9ef933740297862de1173d7
Loki
c079342a5d8fbbdb05e32bf5c3d0e9b93a11a582d7404d448c5db52b08a98163
Loki
+ 6'669 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer suricata trojan
Link:
https://tria.ge/reports/220216-r4qmssdahj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://164.90.194.235/?id=33815737952270720
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
63b6403c6ea1378c0ff49f069597b45496dba6c0161d240e64885ab6f0806d04
MD5 hash:
72b143fd989c37772556bf302ac33be1
SHA1 hash:
ee377db4778e70261d34f8210208069df41a12ef
Link:
https://www.unpac.me/results/da7d39b8-a8bf-4d05-9e23-32e21fff7334/
SH256 hash:
f01d3c2c54456e6372f8aa472db6cc4242bcaa66f05b81ea44bbae4aa4ffd915
MD5 hash:
e1bc043c46c8f788669e1848c7f8dcf9
SHA1 hash:
41bb2192123253ed37ba9936fe4fd77458fa486d
Link:
https://www.unpac.me/results/da7d39b8-a8bf-4d05-9e23-32e21fff7334/
SH256 hash:
108031b1b1a718a296e2dc6e75863b4c66507fa8ef7ff923847518a39c19bf6a
MD5 hash:
595545980de9cc3987ba0ad9221d8183
SHA1 hash:
41b1e796a99e3267beae6741d750c3990c92c62f
Link:
https://www.unpac.me/results/da7d39b8-a8bf-4d05-9e23-32e21fff7334/
SH256 hash:
0c6042266e34e7bbdd65ca4cfdf2c2f0b054bb97621c3cb4471c55727a70bcad
MD5 hash:
823244e7e8ff6e41a63094a598b1cc43
SHA1 hash:
3aa74db831b58665228c84b1df142288c305e545
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/da7d39b8-a8bf-4d05-9e23-32e21fff7334/
Parent samples :
7fe467ef6f392039c0ce5edaadf85c19a8406a0b0b7332131e2b2ddc9f074bb6
70b02ad515a1e01de0be858d8d61932ce951b6b49a9bd39a7a5121be65ef0f4f
5ca60d155deba60b7fd13ffa3498797e4f8c7e4a09d3eb35ccd2c1b15fd7dfb7
955db31cd67526fa78a5488205c03915cd42fe0b5148d04843220dbfc65c01f6
b03e8aef15a28e46401eec5c7ba2cf94a90c492a0c5e6c602c9e2283c0dfda3a
SH256 hash:
5ca60d155deba60b7fd13ffa3498797e4f8c7e4a09d3eb35ccd2c1b15fd7dfb7
MD5 hash:
a68b33523defb37c81df8bb6e66ba03d
SHA1 hash:
48029f8d45453e5538623c18643c1b2c646f683a
Link:
https://www.unpac.me/results/da7d39b8-a8bf-4d05-9e23-32e21fff7334/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/5ca60d155deba60b7fd13ffa3498797e4f8c7e4a09d3eb35ccd2c1b15fd7dfb7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/241931/

Comments