MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b1df4cb218093a57a5646f0d6ece41d548fae6cce51d90d1540686d747069b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 5

Intelligence 5 IOCs YARA File information Comments

SHA256 hash:	6b1df4cb218093a57a5646f0d6ece41d548fae6cce51d90d1540686d747069b6
SHA3-384 hash:	455fda52bc1fb4edbdc2a9fdaf03c23e1b78135750d13bb3412829ea3d2e925953a18aff71737b65acf036093d0ec33e
SHA1 hash:	de252b93e3973af6b256aa59d5b92ad7553ab07b
MD5 hash:	36bf2bd62487253ced42da7e7fa35320
humanhash:	thirteen-happy-gee-minnesota
File name:	Wire Payment.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	316'472 bytes
First seen:	2020-08-18 11:39:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	24f4223e271413c25abad52fd456a9bc (21 x GuLoader, 15 x Loki, 10 x AgentTesla)
ssdeep	6144:3HfYbMx+ToiiRTtpxHKQEKu2yGlvGeXk1R0l36oLIpiK:3vw8i03gGl+G80CF
Threatray	53 similar samples on MalwareBazaar
TLSH	B164135093D5C063C395CD746EB6F1BBABAACF2A59529B0787C03F8C3473560BA6B106
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Malspam distributing Loki:

HELO: secretariavirtual.es
Sending IP: 89.140.72.157
From: "MENUEL, Karine"<nak@naksystem.com>
Reply-To: <kmenu@kidilizgroup.com>
Subject: AW: wire confirmation
Attachment: Wire Payment.rar (contains "Wire Payment.exe")

Loki C2:
http://modevin.ga/~zadmin/lmark/gld/mode.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/47744/

Detection(s):

PUA.Win.Adware.Browserio-6725861-0

SecuriteInfo.com.BehavesLike.Win32.ObfusRansom.bc.6542.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file

Sending a UDP request

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6b1df4cb218093a57a5646f0d6ece41d548fae6cce51d90d1540686d747069b6/

Threat name:

Win32.Trojan.CryptInject

Status:

Malicious

First seen:

2020-08-18 09:48:33 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=nmo7jszbqcj2k6swi3ynn3hedvki7ltmzzi5sdivibug25dqng3a._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

spyware trojan stealer family:lokibot

Link:

https://tria.ge/reports/200818-qc4erhfz2x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Loads dropped DLL

Reads user/profile data of web browsers

Blacklisted process makes network request

Lokibot

Malware Config

C2 Extraction:

http://modevin.ga/~zadmin/lmark/gld/mode.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6b1df4cb218093a57a5646f0d6ece41d548fae6cce51d90d1540686d747069b6