MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65b6cc575eac7e69ccec2d892f7abd25965a301c4b02a7d82a977918edf3b16c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65b6cc575eac7e69ccec2d892f7abd25965a301c4b02a7d82a977918edf3b16c
SHA3-384 hash: fe904f9dbc6136873143624d17e54211b3597b413a63aa2d2cc45fbe5bee8c760ab88ab8b3fd93d8da3484894846ab83
SHA1 hash: 7e1460bc3e8bc53964688dbfce933c204eb1cad8
MD5 hash: b4d3907a0852009a3639e2213920debc
humanhash: pasta-floor-summer-carbon
File name:INQUIRY 824629.exe
Download: download sample
Signature Loki
Create hunting rule
File size:970'240 bytes
First seen:2021-03-16 13:36:50 UTC
Last seen:2021-03-16 15:38:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:YxfouKqS5AhBFOFdMZ5Rf1BySYOGedqPry/61:YrS5AhBFoY5hSFvya
Threatray 10 similar samples on MalwareBazaar
TLSH 97255921E6946AF0F03973754832233053FDAD1A9626EA7D7D4431DA09B4AC185F3EBE
Reporter malwarelabnet
Tags:Loki Lokibot

Intelligence

File Origin
# of uploads :
2
# of downloads :
644
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
INQUIRY 824629.exe
Verdict:
Malicious activity
Analysis date:
2021-03-16 13:40:04 UTC
Tags:
trojan lokibot stealer
Link:
https://app.any.run/tasks/ecaba863-3dc0-48cd-b0df-fa93a2a1899b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.580.18434.14089.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5f08bc4a-0e3f-4b4a-89d2-106fc43e3f5f
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/640750
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/65b6cc575eac7e69ccec2d892f7abd25965a301c4b02a7d82a977918edf3b16c/
Threat name:
ByteCode-MSIL.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 13:37:04 UTC
AV detection:
17 of 47 (36.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mw3myv26vr7gtthmfwes66v5ewlfuma4jmbkpwbks54rr3ptwfwa._file
Verdict:
unknown
Similar samples:
02cd534cf863894a7f2fc488ba077a5e95d31bdddea93de4019c7a9159ac1375
Loki
1857e9e122dd752766c9092043606a957e4e9d56d3ea043b63053054285c1cb4
Loki
6c7624c020bb11d5803286dc0fc1d9ee44d21be97207573051bcd322091a731b
Loki
703170d16b28086934737a474038f62654f595f1f5b30b0115806187022d1df6
Loki
80d3f66ba9b603c7f90d3303718763b736e8cfa76f676ff4a57db67b96610dc6
Loki
aa9692c1769e25297176b847f4274570c56c4d74f4577608bd036e72d82d5bdb
Loki
b903be7c680d5eb78f951c7e1743b53e0cdfae05e19fa6fe7e77c84c29df1156
Loki
c9b11315a65d68d5577ca5b762e4d5d16f660b1ffde12cd5192c9717747a63ca
Loki
e6628a7533fc340c5a6c659ecaba8a7626bc853c96d6e3571427aaaf124edde1
Loki
f782d415e7975acdf521b8a92ceb1e1f5c51c030dfdfdf5d798ad381003ed1bf
Loki
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210316-yjfabgrjhx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://51.195.53.221/p.php/NDMS5HYLrLw5p
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
2b43013edb5706a946f4e523a1a219b31fe2a7e05c48884c048882b3c1327655
MD5 hash:
b7159eb14fe565d4e233604b629bbd8a
SHA1 hash:
64f82c67e6c7cbc078141162a49bffcee3d9ebb9
Link:
https://www.unpac.me/results/606b9034-61ec-40c5-9f48-f67ad90cba60/
SH256 hash:
65b6cc575eac7e69ccec2d892f7abd25965a301c4b02a7d82a977918edf3b16c
MD5 hash:
b4d3907a0852009a3639e2213920debc
SHA1 hash:
7e1460bc3e8bc53964688dbfce933c204eb1cad8
Link:
https://www.unpac.me/results/606b9034-61ec-40c5-9f48-f67ad90cba60/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/65b6cc575eac7e69ccec2d892f7abd25965a301c4b02a7d82a977918edf3b16c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments