MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6605187766e50cfa608d95f9379a38d4b2e7933a74b50b6b56cac288846007bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	6605187766e50cfa608d95f9379a38d4b2e7933a74b50b6b56cac288846007bb
SHA3-384 hash:	b7ca37ff116c0736123a23bf57adff2567e7e09487d53743e96126d5aed55525b07dc457b98119c6664473db9a471238
SHA1 hash:	e3cd26775338613216596f835413be9084fd6b26
MD5 hash:	3f94090e74aa6b2866be9dac6414523f
humanhash:	lima-saturn-high-missouri
File name:	RFQ#20210709.ISO
Download:	download sample
Signature	Loki Create hunting rule
File size:	1'245'184 bytes
First seen:	2021-07-10 06:02:20 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	12288:XZO1YsMgwKNg9D04G7qZeLB2eUsSSvmr47xebF9dnI0BdBqMw/RCkomwtAeifp39:JOl2YautBxvC9ZiSsPhuf/bFk
TLSH	T1DD457C3D2CB70581C7F9C779D66055E88FB5A0E48376E23C2C8E786D24D8B54B9A2D32
Reporter	cocaman
Tags:	iso Loki

cocaman

Malicious email (T1566.001)
From: ""Purchasing Manager"<cheryl@acmelaser.cn>" (likely spoofed)
Received: "from acmelaser.cn (unknown [103.155.80.90]) "
Date: "9 Jul 2021 11:23:12 -0700"
Subject: "Re:Re:Re: Additional New Order & Request for catalog and price list"
Attachment: "RFQ#20210709.ISO"

Intelligence

File Origin

# of uploads :

# of downloads :

221

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Iso_fs2229.UNOFFICIAL

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6605187766e50cfa608d95f9379a38d4b2e7933a74b50b6b56cac288846007bb/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-07-10 06:03:04 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 46 (34.78%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mycrq53g4ugpuyensx4tpgry2szopez2os2qw22wzlbirbdaa65q._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/210710-estr46kad2/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Lokibot

Malware Config

C2 Extraction:

http://185.227.139.18/dsaicosaicasdi.php/auJMYiGBL7JHG
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/6605187766e50cfa608d95f9379a38d4b2e7933a74b50b6b56cac288846007bb