MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61cf371d87b081dbca8f7dacc088c35238295b5c71c79a8f06ab209dcbc7ff48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 11


Intelligence 11 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61cf371d87b081dbca8f7dacc088c35238295b5c71c79a8f06ab209dcbc7ff48
SHA3-384 hash: 15fd4b48434c61c7a424c00522f65ff181ecf9e437205764cdaf4d73d71282e81f96f060cf2d8252f551439def7748b3
SHA1 hash: fea6f5a46cc52bfa18d9e2fcb2152d279532e0ee
MD5 hash: 6db32b93132d79c5876dc469120f1fc3
humanhash: utah-fourteen-quebec-papa
File name:Oznámenie o platbe - Euro Bank.exe
Download: download sample
Signature Loki
Create hunting rule
File size:822'784 bytes
First seen:2021-01-19 12:59:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:37FCo42Y1e0LwaIKGafFwGafF0GafF67osldPyAgVJakvsBLfArQxpqhSq:LsgYUGwifQf0fQt61BW7ArkAS
Threatray 229 similar samples on MalwareBazaar
TLSH BA05BE952648EE31E169AFB7C86964F043FEAF13D615DD0B6CB43E8E3133D098612D26
Reporter abuse_ch
Tags:exe geo Loki SVK


Avatar
abuse_ch
Malspam distributing Loki:

HELO: zephir.ph
Sending IP: 45.137.22.41
From: ÚČTY / ANCHELÉN <info@zephir.ph>
Subject: Oznámenie o platbe - Euro Bank EFG
Attachment: Oznmenie o platbe - Euro Bank.gz (contains "Oznámenie o platbe - Euro Bank.exe")

Loki C2:
http://becharnise.ir/fa2/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Oznámenie o platbe - Euro Bank.exe
Verdict:
Malicious activity
Analysis date:
2021-01-19 13:07:48 UTC
Tags:
trojan lokibot stealer
Link:
https://app.any.run/tasks/e3b4f9aa-8519-49ff-87e0-ed4aa31cf3c9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/112883/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a file
Reading critical registry keys
Changing a file
Replacing files
DNS request
Moving a file to the %AppData% subdirectory
Creating a process from a recently created file
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Connection attempt to an infection source
Creating a file in the %AppData% subdirectories
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/584989
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 341530 Sample: Ozn#U00e1menie o platbe - E... Startdate: 19/01/2021 Architecture: WINDOWS Score: 100 31 155.155.155.155 DNIC-ASBLK-01550-01601US United States 2->31 37 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->37 39 Multi AV Scanner detection for domain / URL 2->39 41 Found malware configuration 2->41 43 13 other signatures 2->43 8 Ozn#U00e1menie o platbe - Euro Bank.exe 7 2->8         started        signatures3 process4 file5 23 C:\Users\user\AppData\Roaming\fsylcCq.exe, PE32 8->23 dropped 25 C:\Users\user\...\fsylcCq.exe:Zone.Identifier, ASCII 8->25 dropped 27 C:\Users\user\AppData\Local\...\tmpD3DC.tmp, XML 8->27 dropped 29 Ozn#U00e1menie o p...- Euro Bank.exe.log, ASCII 8->29 dropped 11 Ozn#U00e1menie o platbe - Euro Bank.exe 54 8->11         started        15 schtasks.exe 1 8->15         started        17 Ozn#U00e1menie o platbe - Euro Bank.exe 8->17         started        19 2 other processes 8->19 process6 dnsIp7 33 becharnise.ir 104.237.252.85, 49711, 49713, 49714 DEDICATED-FIBER-COMMUNICATIONSUS United States 11->33 35 192.168.2.1 unknown unknown 11->35 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->45 47 Tries to steal Mail credentials (via file access) 11->47 49 Tries to harvest and steal ftp login credentials 11->49 51 Tries to harvest and steal browser information (history, passwords, etc) 11->51 21 conhost.exe 15->21         started        signatures8 process9
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/61cf371d87b081dbca8f7dacc088c35238295b5c71c79a8f06ab209dcbc7ff48/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 13:00:14 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mhhtohmhwca5xsuppwwmbcgdki4csw24ohdzvdygvmqj3s6h75ea._file
Verdict:
suspicious
Similar samples:
2f8daf0f7d0ba0b573b93f3e4ffb75e157a0e78be8a07bde8325dbd0efe42b6b
Loki
7ce968d0fc6d6ef86fa1c73e383a21b7cdd401eeaa9daefad0d2b20de042a8e5
Loki
a55e49e3dffd386fbe1b8cfdafb4bcca81264b48e1fa2f9d68a7b8b12ec2bc7e
Loki
aadf4a2325f03bbc80d38bc0c033e5ecc945a9b132570533f5a3fc41a6e034d6
Loki
bfa8ca8a64dfbdd1b607b72848edc7ed107c90eb72b15c93d520392c201364fd
Loki
d7c81b22b82c19f2c3b05ba1b222e317975cc16f4900db415c8e723c7f2eff06
Loki
de752497070302674c9ff806fc9c905d9ca2db93d8d6241d4849da79394fe172
Loki
f991818096935708b00e812a9700a0215a1583047f2721552a9d6375abf0db75
Loki
fdf7a24b0b6c57dfbee964444a5f7d645e3a306e509ee43c005b13c1dbf9fa50
Loki
fe15f4f81105e03404643fa842168b56482ea6e6772c95f0ffb56c0b0f69678f
Loki
+ 219 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210119-nqprtkje4x/
Behaviour
Creates scheduled task(s)
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://becharnise.ir/fa2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
3aca905cea4ad6441daac7d9699850ffc6e2ec2af6fc12715fe94c8a0f160435
MD5 hash:
3b4679eaae81e4223c226b7c6d513066
SHA1 hash:
c212ed8aaf5acc91431e4cb23ea92b8e9ad6a4f7
Link:
https://www.unpac.me/results/6f2b910c-e926-4e64-840a-684a9bce45fb/
SH256 hash:
3e29a7defe4759669110f1c10222a512c3a229523994d8ef165ad8a4bd8ef512
MD5 hash:
aa2d1dbd6022370b589b36aa9e95940f
SHA1 hash:
5f9832d758dd71f0c367bf415b6ff6401d2ebf70
Link:
https://www.unpac.me/results/6f2b910c-e926-4e64-840a-684a9bce45fb/
SH256 hash:
a32d9e7d05e7d85f17199850eae9f9bdf3b0f295f86205285491a710750a74fd
MD5 hash:
3293cd21913a7b6144d0e8e7a87b1ca8
SHA1 hash:
3d65058a060a421527e5b26c4a2bb9b7b1d9fed2
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/6f2b910c-e926-4e64-840a-684a9bce45fb/
Parent samples :
3f2af5b2d349f4f23fb4ac212666c3d3bdb41fe6976226553022123d78fd7004
e09a6d651f6bbb29c9de2321977d94d7eadf264ca3eb6bd0b7a6876cd6e4866a
6aae2544784eec2f856dc11effdfd79bf9d02c91df9f0ff7170c042d3ee4f848
3ea4d93621845dc92c1d107b744cc193376978b230782bfc87bf3b9a985e5218
51146cdc626be707700c7459883faef7864612af14354aefed988fed9afa136f
4c2ab5026b93ef64569cc15d94bbda9495938c90164355a34c4a4eeeb8badb15
61cf371d87b081dbca8f7dacc088c35238295b5c71c79a8f06ab209dcbc7ff48
SH256 hash:
61cf371d87b081dbca8f7dacc088c35238295b5c71c79a8f06ab209dcbc7ff48
MD5 hash:
6db32b93132d79c5876dc469120f1fc3
SHA1 hash:
fea6f5a46cc52bfa18d9e2fcb2152d279532e0ee
Link:
https://www.unpac.me/results/6f2b910c-e926-4e64-840a-684a9bce45fb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/61cf371d87b081dbca8f7dacc088c35238295b5c71c79a8f06ab209dcbc7ff48

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 6e28633cb7404eba40524a07cde4149b6c215954093bc6c8945382fc9a95feef

Loki

Executable exe 61cf371d87b081dbca8f7dacc088c35238295b5c71c79a8f06ab209dcbc7ff48

(this sample)

  
Dropped by
MD5 49e7d6a46abea193317571bb184b04b1
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/112883/
  
Dropped by
SHA256 6e28633cb7404eba40524a07cde4149b6c215954093bc6c8945382fc9a95feef

Comments