MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64665200a953a20b6f2a51b1071469a1d4984432da6384b76cc2bd81bd66f85a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 17


Intelligence 17 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64665200a953a20b6f2a51b1071469a1d4984432da6384b76cc2bd81bd66f85a
SHA3-384 hash: 666a5d4b5445004b63fbb95a72bfa9b75f8e1a4f17400d6230381a65180fb894e0838a14392622a09b9cc4c2e77f1da3
SHA1 hash: 86cf4eefa5867518636070d71ef8448d8901c880
MD5 hash: f17d5a8b9a853e6f1647cfe74dfa8db8
humanhash: alaska-low-pizza-venus
File name:Purchase Order 02.07.2024.PDF.cmd.exe
Download: download sample
Signature Loki
Create hunting rule
File size:623'112 bytes
First seen:2024-07-02 09:20:21 UTC
Last seen:2024-07-02 10:22:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'473 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:UlrujSANT3ukfuZt1h/PyOgDvIZfcHgGc+4016Wm8+VWo2TtEtrddZN5/RqUQekR:UlqjFT3ukGrnPyPvI1cHg3WCVWLF
TLSH T19BD4F088768071DFC96BC872DEA82C20EB207577531BDA039457229C994E9EBDF250F7
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon f2ceaeaeb2968eaa (68 x RedLineStealer, 21 x AgentTesla, 18 x AveMariaRAT)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://45.61.136.239/index.php/gyr.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://45.61.136.239/index.php/gyr.php https://threatfox.abuse.ch/ioc/1292470/

Intelligence

File Origin
# of uploads :
2
# of downloads :
491
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
64665200a953a20b6f2a51b1071469a1d4984432da6384b76cc2bd81bd66f85a.exe
Verdict:
Malicious activity
Analysis date:
2024-07-02 09:21:28 UTC
Tags:
lokibot stealer trojan
Link:
https://app.any.run/tasks/6d8b568d-0150-4b55-afb6-f64f14ad5ca7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.9418.12935.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6683c684251d4687fe42dc07win10vpnfull_triage
Tags:
Encryption Execution Network Static Stealth
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Launching a process
Creating a file
Reading critical registry keys
Changing a file
Connection attempt
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Stealing user critical data
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/64665200a953a20b6f2a51b1071469a1d4984432da6384b76cc2bd81bd66f85a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/23e5b380-2e8a-4fa6-88cb-d39816e16c97
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1465981
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/64665200a953a20b6f2a51b1071469a1d4984432da6384b76cc2bd81bd66f85a
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/64665200a953a20b6f2a51b1071469a1d4984432da6384b76cc2bd81bd66f85a/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2024-07-02 09:21:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mrtfeafjkoraw3zkkgyqofdjuhkjqrbs3jryjn3myk6ydplg7bna._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection execution spyware stealer trojan
Link:
https://tria.ge/reports/240702-lbbehswbna/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Lokibot
Malware Config
C2 Extraction:
http://45.61.136.239/index.php/gyr.php?id=1
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c013e656-dd48-481f-94ae-5df81337b106
Unpacked files
SH256 hash:
a72a4a4cdda9902e57c5da5d598a97c17eb31856d455e8f6ec4124cb78b4a2b4
MD5 hash:
e8736786018bbfaf2be229a19ad5bceb
SHA1 hash:
fb14688d5f7e717fd5084d6039914a991813a0a8
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Lokibot
Create hunting rule
SUSP_XORed_URL_In_EXE
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
STEALER_Lokibot
Create hunting rule
Link:
https://www.unpac.me/results/8a36e677-0ef1-4d2b-93ef-0f142dca3b49/
Parent samples :
64665200a953a20b6f2a51b1071469a1d4984432da6384b76cc2bd81bd66f85a
b2059d6bde8d6af8476a968a13f14486edf3c905495a36cd963dc9765c40863a
dc98561aa04c9c3d9297d9cbb0612db5c537d2d44381265263c30433b7b955ae
SH256 hash:
889d99e2cc8a8ab5359f652482659b38955a1750e8d048d23965cbb8f982402d
MD5 hash:
5bc68c423b87962c8cf876acd910c935
SHA1 hash:
a810ea8180ba671219c2064e0e3f26d5efc9b775
Link:
https://www.unpac.me/results/8a36e677-0ef1-4d2b-93ef-0f142dca3b49/
SH256 hash:
8202cb35fda1b696dae87bb32783736cc4be66a081c3e67567103037b784fd42
MD5 hash:
448e3ecc8349eecac9a881597c3d57b7
SHA1 hash:
39090dec205294d185684d302721cc44ed03f56b
Link:
https://www.unpac.me/results/8a36e677-0ef1-4d2b-93ef-0f142dca3b49/
Parent samples :
e861afaa4755a6f42c02be20ea94ea195e45b8a952928a76692bc146decb78fe
a6c97c54c4bebd6114ddcfac0414fb0d432877d2916012c8a5fc2cfb45d9346d
0903961ba7ce91a965ee42d92da305ecf174b588351dbac5bd7f53506cc5a0f3
1983ca8eb7b0270ef0681fa6fd3d1ca8cdf416800c2403be82e8d6cf2b722f12
3c1f8c10253bfe7388f5d51391a2253b56e348f92ec68ad70f78a4d7f526147d
SH256 hash:
4f7095783d0917a8b1225d903f03a1a69c11c1a4017acc6111018792d23724be
MD5 hash:
7480ee3941b5805b2dec159178a827d1
SHA1 hash:
04e94f199a68c0f81e6058e25da1d963d16d856c
Link:
https://www.unpac.me/results/8a36e677-0ef1-4d2b-93ef-0f142dca3b49/
SH256 hash:
64665200a953a20b6f2a51b1071469a1d4984432da6384b76cc2bd81bd66f85a
MD5 hash:
f17d5a8b9a853e6f1647cfe74dfa8db8
SHA1 hash:
86cf4eefa5867518636070d71ef8448d8901c880
Detections:
INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Link:
https://www.unpac.me/results/8a36e677-0ef1-4d2b-93ef-0f142dca3b49/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/64665200a953a20b6f2a51b1071469a1d4984432da6384b76cc2bd81bd66f85a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments