MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 628dfd34daff8a0bf381c3bdf5a106ed0de213d6aabfd68e3f3b2276afb0e58b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 628dfd34daff8a0bf381c3bdf5a106ed0de213d6aabfd68e3f3b2276afb0e58b
SHA3-384 hash: 4928acb70ff84c377bf0cb93ad36d9e2265008e543241a63ab9f8ed372be92c8874fac7b38ae7ec4a223b9d5e7a6bf8a
SHA1 hash: 1beb14d8e884c0b18682bed85b908aa6935474dc
MD5 hash: 2252c10dac018b75c4d7aa12b96d178c
humanhash: mango-princess-island-carolina
File name:RFQ T2021-000615 18-06-2021·pdf.exe
Download: download sample
Signature Loki
Create hunting rule
File size:144'552 bytes
First seen:2021-06-18 02:31:36 UTC
Last seen:2021-06-18 03:44:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash be40f0cd8fddbab623f92878bcc02d13 (1 x Loki)
ssdeep 1536:HuvUyiDZY2DE12V6Rkne0BXuD2TU5sml8zCXoH+i:2UyiDTDnIOne0Bm2br+i
Threatray 5'008 similar samples on MalwareBazaar
TLSH 20E39E61F2EC6C11E2928730E575C63E9B967C715A02CF076358B70F2E347C692BA52B
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://63.141.228.141/32.php/Gi4uJRts3jTJM

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://63.141.228.141/32.php/Gi4uJRts3jTJM https://threatfox.abuse.ch/ioc/135851/

Intelligence

File Origin
# of uploads :
2
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ T2021-000615 18-06-2021·pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-06-18 02:32:46 UTC
Tags:
trojan lokibot stealer
Link:
https://app.any.run/tasks/4d211533-c6b7-4bb3-b18d-8f577ffe344f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Guloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/166709/
Detection(s):
SecuriteInfo.com.__vbaHresultCheckObj.14016.7927.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/bc9f3d12-4f0f-4ea9-ac17-4f8235c8d1b1
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/804066
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Found malware configuration
Hides threads from debuggers
Potential malicious icon found
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
guloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/628dfd34daff8a0bf381c3bdf5a106ed0de213d6aabfd68e3f3b2276afb0e58b/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-06-18 02:32:11 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mkg72ng276fax44byo67liig5ug6ee6wvk75ndr7hmrhnl5q4wfq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
42b2f84e503000a98a9aa9f476d104389bdd766b74c3899b34a01b73138ea56d
Loki
6147decc439b9d258f5b19f77dfa47ea441e681c49e0b699533eea18104f4092
Loki
821bc12d61a9ad2698823b6f54bbba6b8e9fba81a167a438f7da728d1dcd381d
Loki
8f1517666a1f5f7f6d0f38814909251d41de92126c2a7df0626de2fa1ae9ba1f
Loki
98e5506923c5be78a8a1789c8b29b810e99754fdd8e47c5a0e729fec9aaf744c
Loki
a33b31af132d492e1eb511ed37087a9c52af1f7dd575fa63634fa9b4170daaa7
Loki
b59374ff4efaa214c04a353aa3cf500ca22c43b63f27d0c3fb0495bd942ac734
Loki
ced266ad59923661e84dca65e4412e0b99a11fe4868f4219142ebc49a8308fb2
Loki
d9da34178f5af034a46aa98a5df2b516854bc866670358c18c5c61266a8fd351
Loki
e4effdebb79bd1b3d2e3a2510a96f44cbf9ca4961340c7ca1f276bd3c527afb2
Loki
+ 4'998 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:lokibot downloader spyware stealer trojan
Link:
https://tria.ge/reports/210618-692d5bvmp2/
Behaviour
Modifies system certificate store
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Checks QEMU agent file
Guloader,Cloudeye
Lokibot
Malware Config
C2 Extraction:
https://drive.google.com/uc?export=download&id=1t6bCf6ayEMFIXyzY0Q1ZAo46QFsprZxv
http://63.141.228.141/32.php/Gi4uJRts3jTJM
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
49b04162c412105ab0857de16713724cbf3234a0b6ba51f3a5286312633f20c3
MD5 hash:
1f1b425190b2fb0396ad2d538b1060ba
SHA1 hash:
413f98641d46fdcabfcaf64f29495667de6282ea
Link:
https://www.unpac.me/results/f492e9d6-6f71-4646-b0e7-d57d0016448c/
SH256 hash:
628dfd34daff8a0bf381c3bdf5a106ed0de213d6aabfd68e3f3b2276afb0e58b
MD5 hash:
2252c10dac018b75c4d7aa12b96d178c
SHA1 hash:
1beb14d8e884c0b18682bed85b908aa6935474dc
Link:
https://www.unpac.me/results/f492e9d6-6f71-4646-b0e7-d57d0016448c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/628dfd34daff8a0bf381c3bdf5a106ed0de213d6aabfd68e3f3b2276afb0e58b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/166709/

Comments