MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61d80562a0ead0d9a3fc80089b437847365c5c5010fa7a060467649f0f6dcbea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash:	61d80562a0ead0d9a3fc80089b437847365c5c5010fa7a060467649f0f6dcbea
SHA3-384 hash:	735d354052887c00f60b0757e2441dee3eae0dd52565f68df9b7bfc52c8e7dccc70ea2ef43922ec3f59ee92c209ef39c
SHA1 hash:	b2330ffde73d810d58d4729f75d5138b582e0817
MD5 hash:	96c239ac0e277280b28538929379318c
humanhash:	nitrogen-december-virginia-tennessee
File name:	Remittance - 120722.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	659'456 bytes
First seen:	2022-07-19 16:01:57 UTC
Last seen:	2022-07-19 16:53:40 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	12288:zGIYFLd0bqxlCZSBe938lhS3PvNCWb2gb3IU3ScaFlSNSZ3:zGxFGqxlzUZmhSfvsO9VaQSZ3
Threatray	8'457 similar samples on MalwareBazaar
TLSH	T147E4122237A4A919CB6E4F3B6433D10066B5B79535A1EB8FBD80175F1D673488B02F2B
TrID	64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.5% (.SCR) Windows screen saver (13101/52/3) 9.2% (.EXE) Win64 Executable (generic) (10523/12/4) 5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	GovCERT_CH
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

270

Origin country :

n/a

Vendor Threat Intelligence

Detection:

LokiBot

Link:

https://www.capesandbox.com/analysis/291930/

Detection(s):

SecuriteInfo.com.W32.AIDetectNet.01.23595.14083.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Creating a file

Enabling the 'hidden' option for analyzed file

Moving of the original file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/62d6d5d780dba4f80a247958/reports/6b2b1005-49c1-4dec-9cef-54f8226f9da8/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9b72fbaa-b060-40b4-ab4b-8520327c6251

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1036653

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Generic Downloader

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/61d80562a0ead0d9a3fc80089b437847365c5c5010fa7a060467649f0f6dcbea/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-07-19 13:20:27 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

27 of 40 (67.50%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mhmakyva5linti74qaejwq3yi43fyxcqcd5hubqem5sj6d3nzpva._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Loki

6890a2648a49013e3688112f61e35b2eab3d39cbd8a259244f8984b74bc08d3c

Loki

795e024722b66cec49e060a39d2c0b9ce4b66981dc027f19f8a91f64db569387

Loki

8038edc06ea50632b0a2f700361ebbb6e9153507dc51e063b90a96cd9dbbadde

Loki

e99f0195f624b2fa3304e3449916bb65bbcba86838a23020bd49cefa1b10065d

Loki

e9a4a25b66b32dc8de0543704765c91f942d90c3fef91c5ff16c1f2a5930aebc

Loki

+ 8'447 additional samples on MalwareBazaar

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/220719-tgryfsfbe8/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://198.187.30.47/p.php?id=30475797962175744
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

488980dff419648622376279417570bba04e7a6028df2519229a73aa5fcbee77

MD5 hash:

4471612fea589ef25b5c1790df41a765

SHA1 hash:

e4bc2438e3524a2f49f123e16e923c96462ae8bd

Link:

https://www.unpac.me/results/fd3b627b-8941-4d41-9679-90e6daababd0/

SH256 hash:

39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807

MD5 hash:

db51fe170a9e5d6ec5429a2fbd9d0353

SHA1 hash:

e30a58125fc41322db6cf2ccb6a6d414ed379016

Link:

https://www.unpac.me/results/fd3b627b-8941-4d41-9679-90e6daababd0/

SH256 hash:

a93d58c245807b845b4f3e189e9374ae973026e957ed69ed7743eeb37d3da27a

MD5 hash:

28703c41180b06d9a5dd73c7ddab939f

SHA1 hash:

a6fdde024b07e8ba22d85e8df0bfa7731f63ce13

Detections:

win_lokipws_g0

win_lokipws_auto

lokibot

Link:

https://www.unpac.me/results/fd3b627b-8941-4d41-9679-90e6daababd0/

Parent samples :

11418a5c3b08b349b9486e9da2e2e518e6e75d73e09f0b54cf52d8d3279ba7ee
61d80562a0ead0d9a3fc80089b437847365c5c5010fa7a060467649f0f6dcbea
52b18494008811d0277d2a3397df855d80a9575c09e11225950fd9f505850346
c06b233c21eaa5fad5a2758cc53b521201b7d5ead1203b6a79da319915b98852
cab01fab9c4e5b7f99d5f1fb4df3b33517db363fbf92efba8ea9e61dfc684547

SH256 hash:

cca33e028af752b44a3ad612edd024251edd738396e6cbcb712636614d64a3dc

MD5 hash:

2a70684af365233857f364f594f8697b

SHA1 hash:

a4562950fe8828c3e542cdb79457b1853c47d6f1

Link:

https://www.unpac.me/results/fd3b627b-8941-4d41-9679-90e6daababd0/

SH256 hash:

c17ae6ccfd7057266585d779e33e971e44f3ce2ca7708a2c3679f7ad7c32e16c

MD5 hash:

70b1f122c3622f2200c8443ba7a3e67b

SHA1 hash:

71ffd0a0db6025cea57683d7e4e34eef1554939f

Link:

https://www.unpac.me/results/fd3b627b-8941-4d41-9679-90e6daababd0/

SH256 hash:

61d80562a0ead0d9a3fc80089b437847365c5c5010fa7a060467649f0f6dcbea

MD5 hash:

96c239ac0e277280b28538929379318c

SHA1 hash:

b2330ffde73d810d58d4729f75d5138b582e0817

Link:

https://www.unpac.me/results/fd3b627b-8941-4d41-9679-90e6daababd0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/61d80562a0ead0d9a3fc80089b437847365c5c5010fa7a060467649f0f6dcbea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.