MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d8c529984c1d4acd8630ad5a2de690ac8e485a11adeb25b6535805c5e3f2166. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 5

Intelligence 5 IOCs YARA File information Comments

SHA256 hash:	5d8c529984c1d4acd8630ad5a2de690ac8e485a11adeb25b6535805c5e3f2166
SHA3-384 hash:	23b102cc19aedc6a8c07acb218015e2c2d186909d49fea614174366c1768a779cf742d8d3a1824a228d6264177d5e1ba
SHA1 hash:	811e43b5a3f8ff9aa242bfd1d78048d2b467f328
MD5 hash:	e24200f2f74f442c93fcbb46d9633116
humanhash:	coffee-lithium-charlie-oxygen
File name:	Shipping Documents.rar
Download:	download sample
Signature	Loki Create hunting rule
File size:	523'298 bytes
First seen:	2022-04-20 10:30:54 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:8vGMAIYzgDwnsX7gIZx+PNi6CAi+PnwHiFhnDLtzvLTLcOxj:nM/YzgDwnsrXUIPRYSiFhDLtzjsa
TLSH	T16EB423D224ABD8D615E24768616BBEEBA43C3E731A9C5E4433F2D5E19EC8F9C068D010
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	Loki rar Shipping

cocaman

Malicious email (T1566.001)
From: "Selva Kumar <selva@40.fmnbvii.sbs>" (likely spoofed)
Received: "from hp0.40.fmnbvii.sbs (hp0.40.fmnbvii.sbs [188.166.147.237]) "
Date: "Wed, 20 Apr 2022 01:04:21 -0700"
Subject: "RE:Shipimet Documentsmn"
Attachment: "Shipping Documents.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

105

Origin country :

n/a

Vendor Threat Intelligence

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

control.exe obfuscated packed update.exe

Link:

https://www.filescan.io/uploads/625fe1deffe27d5119167071/reports/41f817cc-90d4-465f-9ecd-051f5f12f320/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5d8c529984c1d4acd8630ad5a2de690ac8e485a11adeb25b6535805c5e3f2166/

Threat name:

ByteCode-MSIL.Trojan.LokiBot

Status:

Malicious

First seen:

2022-04-20 21:39:18 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

20 of 41 (48.78%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lwgffgmeyhkkzwddblk2fxtjbleojbnbdlplew3fgwafyxr7efta._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220420-mkezqsdbfp/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://198.187.30.47/p.php?id=17642814389135937
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.38

Link:

https://yomi.yoroi.company/submissions/5d8c529984c1d4acd8630ad5a2de690ac8e485a11adeb25b6535805c5e3f2166