🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cc4dd5ffee97ebffb2022cef577072a6414e5f98a65b5954edd260a698f6a1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5cc4dd5ffee97ebffb2022cef577072a6414e5f98a65b5954edd260a698f6a1e
SHA3-384 hash: 4ca7355c8a951d168f2edbc1de92a1dd0393ca3ef36f7962bd6f7cb0d2495a137c1e353b0762d8f45b1d772a58328c15
SHA1 hash: 1448b0aa3a59c0609c3a28cc05ac7ad3873bf6ea
MD5 hash: 9572e7f2a3acc1e251d788e361c7ed8a
humanhash: social-neptune-oklahoma-crazy
File name:Documents.cab
Download: download sample
Signature Loki
Create hunting rule
File size:28'304 bytes
First seen:2022-06-28 12:04:55 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 768:JJ+WDmnVfFjyuBWTaWFNeCVpWBARFgsmHIa1kKIA:ZDm7jATa+XrWMFh4I5K3
TLSH T189D2F1CFFFA91555F6FDC9622F660F22DCE6028C29D109781D2175BDEC28EE68408D09
Reporter 0xToxin
Tags:cab Loki Lokibot

Intelligence

File Origin
# of uploads :
1
# of downloads :
317
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/62baee73197c837506cbb96c/reports/53296302-27d1-454c-a8ca-c10113d7f86b/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5cc4dd5ffee97ebffb2022cef577072a6414e5f98a65b5954edd260a698f6a1e/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2022-06-28 12:05:06 UTC
File Type:
Binary (Archive)
Extracted files:
21
AV detection:
16 of 26 (61.54%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ltcn2x765f7l76zaelhpk5yhfjsbjzpzrjs3lfko3utau2mpnipa._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer suricata trojan
Link:
https://tria.ge/reports/220628-n86b9sbba9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Lokibot
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://198.187.30.47/p.php?id=19405398078735015
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5cc4dd5ffee97ebffb2022cef577072a6414e5f98a65b5954edd260a698f6a1e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab 5cc4dd5ffee97ebffb2022cef577072a6414e5f98a65b5954edd260a698f6a1e

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments