MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e3322a3a24b94c3b8355d8ebc8afb9ea0ea3eb309736181f9d72728199d9794. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 17


Intelligence 17 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e3322a3a24b94c3b8355d8ebc8afb9ea0ea3eb309736181f9d72728199d9794
SHA3-384 hash: 364bf0be4e6256ea29b7dd7feb4c2a970dfa86d9a016d0e194fd6633ba584578ec5496b492d9327772123127cb104834
SHA1 hash: 3ea543a37018b8508baae8da3d9b3481f87252ef
MD5 hash: b02e6e6ec6abc24c2a6fca969699d8e7
humanhash: illinois-august-high-oranges
File name:b02e6e6ec6abc24c2a6fca969699d8e7.exe
Download: download sample
Signature Loki
Create hunting rule
File size:1'417'216 bytes
First seen:2023-04-05 18:10:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:Q8F+0eKTosPn5f85ufAma9V9I/WUf03UCLhbKrRbN6A:TfsKnekfAma9I5f0xLhbWh5
Threatray 1'971 similar samples on MalwareBazaar
TLSH T12F65DF1263ED8360CF735273B625AB01AFBB78A50520FD5F2FD41B79AF60162520E663
TrID 88.3% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
4.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.0% (.EXE) Win32 Executable (generic) (4505/5/1)
0.9% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://solefex.com/cream/five/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
240
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
b02e6e6ec6abc24c2a6fca969699d8e7.exe
Verdict:
Malicious activity
Analysis date:
2023-04-05 18:13:11 UTC
Tags:
trojan lokibot
Link:
https://app.any.run/tasks/67e1225a-482b-4ff3-9463-70987f285121

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/380411/
Detection(s):
Win.Trojan.Generic-9796434-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Сreating synchronization primitives
Sending a custom TCP request
Reading critical registry keys
Changing a file
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Stealing user critical data
Query of malicious DNS domain
Unauthorized injection to a system process
Sending an HTTP POST request to an infection source
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/76698/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckNumberOfProcessor
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit greyware hawkeye keylogger packed shell32.dll
Link:
https://www.filescan.io/uploads/642db9c5497fb6f23efd96f4/reports/36d91d8e-26c5-4aa6-879b-249047035c37/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/6e3322a3a24b94c3b8355d8ebc8afb9ea0ea3eb309736181f9d72728199d9794
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e9639163-4694-412b-b2f0-39d20b15f66d
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1209156
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e3322a3a24b94c3b8355d8ebc8afb9ea0ea3eb309736181f9d72728199d9794/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-04-01 19:04:44 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
21 of 23 (91.30%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nyzsfi5cjokmhobvlwhlzcx3t2qoupvtbfzwdapz24tsqgm5s6ka._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
391b079f44623381b2b2c9a6d6df08175e9779aefd7ae8fb9b369f5dac6c2188
Loki
50b314825821a231dd4a13782bd1c927a590e30d186fe1ed28fd26940a9ee5e0
Loki
78b048f04b9e8f67609d91321edbf8cf27d3b94cafda8210568d67002c09855d
Loki
8019700bd27aecf2c5a6874494f5d897aea450cfe806435f7fe28680487dcc8a
Loki
964df50eae0a8ed963ad142446e3ce8f347e5f1bcb86c87b0acda067ff4dce70
Loki
9e26d68332abb02fb2e80a924f83eb8614afe4e8b841f51c9f82fd0c986d4571
Loki
a222c72eef87b0ef0c5fbcd0847e10d0c788c05a4ed3dfd174aae6a7e4604f33
Loki
b6423a90227ed2d30952943cdfc63e4f31b2c79a15f80e5f2fb6aa9efb75dcbe
Loki
b9464d27c038d3f5cdd28f88083396b4e29a7fa78cdb384b572f3f13c3fd5a3c
Loki
ca80e46167f7c8dd33ca38ecff1c2c19704a80735caa1c4b49498e0bc255b2cb
Loki
+ 1'961 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/230405-wsla6aaf9t/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Lokibot
Malware Config
C2 Extraction:
http://solefex.com/cream/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
1ef797cf2ee0ac79f7e36eb1274288e553a14359a910304759d6b70853e6d12d
MD5 hash:
68e2bc24c75a08096493b5e77d22c5da
SHA1 hash:
7705f08337278050b1b373f1294c81aa1af2b613
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
Link:
https://www.unpac.me/results/7063ad46-ee6b-4bc4-b573-d612699e971b/
SH256 hash:
6e3322a3a24b94c3b8355d8ebc8afb9ea0ea3eb309736181f9d72728199d9794
MD5 hash:
b02e6e6ec6abc24c2a6fca969699d8e7
SHA1 hash:
3ea543a37018b8508baae8da3d9b3481f87252ef
Link:
https://www.unpac.me/results/7063ad46-ee6b-4bc4-b573-d612699e971b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e3322a3a24b94c3b8355d8ebc8afb9ea0ea3eb309736181f9d72728199d9794

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/380411/

Comments