MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64ffb73a1276e203228435365263f1f53ce13722454ac08f092533b02c05104e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 15

Intelligence 15 IOCs YARA 12 File information Comments 1

SHA256 hash:	64ffb73a1276e203228435365263f1f53ce13722454ac08f092533b02c05104e
SHA3-384 hash:	5447ca7ef8001cb823df448d1a09b45a5bf37705ed9ca2d4d9dc3fb6cb63a5be23469e47d73ede06191366d49331d2df
SHA1 hash:	ebd797f9659a3a20a137b55e102f627e9a097eaa
MD5 hash:	bf5ad5ce60c095fd0e15435c7c7ab862
humanhash:	moon-mockingbird-mexico-table
File name:	bf5ad5ce60c095fd0e15435c7c7ab862
Download:	download sample
Signature	Loki Create hunting rule
File size:	182'784 bytes
First seen:	2021-11-03 18:19:45 UTC
Last seen:	2021-11-04 09:58:13 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ed38ab5cc3f4fd753cddd79c6cfea0fc (1 x Stop, 1 x Loki)
ssdeep	3072:g8UwhW8UFLiE+LnCm5ORYIqLC8HpUufaXZxsfB/Vs:gb8UN+LnDORYfHpJisfBa
Threatray	5'896 similar samples on MalwareBazaar
TLSH	T12104AE21F2D3E432D5965170D878DAB01EFBBC725A70518F3BA43B2E1EB06C05A66376
File icon (PE):
dhash icon	480c1c4c4f594b14 (172 x Smoke Loader, 134 x RedLineStealer, 98 x Amadey)
Reporter	zbetcheckin
Tags:	32 exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

112

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

vbc.exe

Verdict:

Malicious activity

Analysis date:

2021-11-03 06:12:26 UTC

Tags:

trojan lokibot stealer

Link:

https://app.any.run/tasks/6d3829a1-faf1-447d-9bdc-40feac9da0a7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/201944/

Detection(s):

SecuriteInfo.com.Heur.Mint.Titirez.lu0@iffAx7fG.30670.10126.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Reading critical registry keys

Changing a file

Replacing files

Connection attempt to an infection source

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Stealing user critical data

Query of malicious DNS domain

Moving of the original file

Sending an HTTP POST request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

diskwriter greyware packed smokeloader

Link:

https://www.filescan.io/uploads/6182d2d61c62c35660816c8e/reports/890e3e0a-bb67-4d1f-bb0e-c1ab2636b554/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/941e9198-0feb-47e6-80c1-28ecc348e394

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/882748

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/64ffb73a1276e203228435365263f1f53ce13722454ac08f092533b02c05104e/

Threat name:

Win32.Trojan.MintTitirez

Status:

Malicious

First seen:

2021-11-02 18:01:02 UTC

AV detection:

35 of 45 (77.78%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mt73ooqso3ragiuegu3fey7r6u6ocnzcivfmbdyjeuz3alafcbha._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/211103-wyrp5aedd8/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

outlook_office_path

outlook_win_path

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://secure01-redirect.net/fd11/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

646d970fc23911f538faefd956eb87b1a956609c2af6d3213e15ef0d851d7e07

MD5 hash:

07c283b36280aac39eba0953212878eb

SHA1 hash:

e58e3af4a3e1cba07898f98449a16460d5eaaf37

Detections:

win_lokipws_g0

win_lokipws_auto

Link:

https://www.unpac.me/results/e31903e5-46e7-4c7f-9b34-7bda8627c093/

Parent samples :

c535edfc3c3a0b7421903298329a5931db817c5d3cc395bbf257724b9060cb3b
64ffb73a1276e203228435365263f1f53ce13722454ac08f092533b02c05104e
721426db54e80aa93306294236b93eda43ee5fe69ea47f27ac33a0ec6bf0dd74
0a66966f403ae52a8cbdc75066d7fe488ff6b152a05bb945a5b92e9b4ecf51d9
ee01efe5bc64a5e50dc0c495edea7d102d8f851bbe4f37f3ed91279c2e1fd2a5
3adcd6bfdb97a238c80d0cf8554fe4cabc22c50e03bd16985f8fcc02deb90f05
8e08e11a06efa2ed04641873284bb209fc777f147fbe7188d10b442f8bc8e3d3

SH256 hash:

64ffb73a1276e203228435365263f1f53ce13722454ac08f092533b02c05104e

MD5 hash:

bf5ad5ce60c095fd0e15435c7c7ab862

SHA1 hash:

ebd797f9659a3a20a137b55e102f627e9a097eaa

Link:

https://www.unpac.me/results/e31903e5-46e7-4c7f-9b34-7bda8627c093/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/64ffb73a1276e203228435365263f1f53ce13722454ac08f092533b02c05104e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	SUSP_XORed_URL_in_EXE Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lokipws.

Rule name:	XOREngine_Misc_XOR_Func Create hunting rule
Author:	smiller cc @florian @wesley idea on implementation with yara's built in XOR function
Description:	Use with care, https://twitter.com/cyb3rops/status/1237042104406355968