MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ff407811ce5f14f5302bcb2646e67946293cb333f6c8550801d80fea2af9ec1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ff407811ce5f14f5302bcb2646e67946293cb333f6c8550801d80fea2af9ec1
SHA3-384 hash: f31bdfee2529cb8c1822d672ad087b85ddcb57fc71fdc743ef3fcd230d937ec68d5acfcc3b2a4c445a2251f50cc7339e
SHA1 hash: 9fe97ca78a39d50bfa2610e3f4b8a76e4db78377
MD5 hash: 641139188c9eb5ee84d12eebb22e0dad
humanhash: harry-oranges-mobile-pluto
File name:????.vbs
Download: download sample
Signature Loki
Create hunting rule
File size:35'571 bytes
First seen:2024-09-24 08:20:15 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:3Y2yRfD0I1dAONNjvmRr/fZzhACSFKeEQ:UfII1dpbjy9zhAhU6
Threatray 4'417 similar samples on MalwareBazaar
TLSH T1ACF29C65D845635401A373A3CCA98FF7B4A821715CB7346C3B24A0D97C85E08E79E9EF
Magika vba
Reporter abuse_ch
Tags:Loki vbs


Avatar
abuse_ch
Loki C2:
http://137.184.191.215/index.php/039

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://137.184.191.215/index.php/039 https://threatfox.abuse.ch/ioc/1328766/

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan-Downloader.VBS.Agent.32449.31138.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66f276718aca58c2b2c709c1
Tags:
Execution Network Stealth Monitor Gumen Sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated powershell
Link:
https://www.filescan.io/uploads/66f276761d8effc31dc554f0/reports/52bedd87-626d-4a2f-907b-715707bbb40e/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/6ff407811ce5f14f5302bcb2646e67946293cb333f6c8550801d80fea2af9ec1
Result
Threat name:
GuLoader, Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1516479
Signature
AI detected suspicious sample
Antivirus detection for URL or domain
Found suspicious powershell code related to unpacking or dynamic code loading
Malicious sample detected (through community Yara rule)
Obfuscated command line found
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
VBScript performs obfuscated calls to suspicious functions
Very long command line found
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected GuLoader
Yara detected Lokibot
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1516479 Sample: ____.vbs Startdate: 24/09/2024 Architecture: WINDOWS Score: 100 40 drive.usercontent.google.com 2->40 42 drive.google.com 2->42 58 Suricata IDS alerts for network traffic 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 Antivirus detection for URL or domain 2->62 64 8 other signatures 2->64 10 wscript.exe 1 2->10         started        signatures3 process4 signatures5 70 VBScript performs obfuscated calls to suspicious functions 10->70 72 Suspicious powershell command line found 10->72 74 Wscript starts Powershell (via cmd or directly) 10->74 76 2 other signatures 10->76 13 powershell.exe 14 19 10->13         started        process6 dnsIp7 48 drive.google.com 216.58.206.78, 443, 49702, 49709 GOOGLEUS United States 13->48 50 drive.usercontent.google.com 216.58.212.161, 443, 49703 GOOGLEUS United States 13->50 86 Obfuscated command line found 13->86 88 Very long command line found 13->88 90 Found suspicious powershell code related to unpacking or dynamic code loading 13->90 17 cmd.exe 1 13->17         started        20 cmd.exe 1 13->20         started        22 conhost.exe 13->22         started        signatures8 process9 signatures10 52 Suspicious powershell command line found 17->52 54 Wscript starts Powershell (via cmd or directly) 17->54 56 Very long command line found 17->56 24 powershell.exe 15 17->24         started        process11 signatures12 66 Writes to foreign memory regions 24->66 68 Found suspicious powershell code related to unpacking or dynamic code loading 24->68 27 wabmig.exe 1 83 24->27         started        32 cmd.exe 1 24->32         started        34 wabmig.exe 24->34         started        36 wabmig.exe 24->36         started        process13 dnsIp14 44 137.184.191.215, 49711, 49712, 49713 PANDGUS United States 27->44 46 142.250.185.129, 443, 49710 GOOGLEUS United States 27->46 38 C:\Users\user\AppData\Roaming\...\31437F.exe, PE32 27->38 dropped 78 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 27->78 80 Tries to steal Mail credentials (via file / registry access) 27->80 82 Tries to harvest and steal ftp login credentials 27->82 84 Tries to harvest and steal browser information (history, passwords, etc) 27->84 file15 signatures16
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/6ff407811ce5f14f5302bcb2646e67946293cb333f6c8550801d80fea2af9ec1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ff407811ce5f14f5302bcb2646e67946293cb333f6c8550801d80fea2af9ec1/
Threat name:
Script-WScript.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2024-09-24 08:21:06 UTC
File Type:
Text (VBS)
AV detection:
7 of 38 (18.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n72apai44xyu6uycxszgi3thsrrjhszth5wikueadwap5ivpt3aq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
lokibot
Create hunting rule
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
04f557582bc8b4c4af843d0c837124da73f887ac5b997efdd78f96d45caced85
Loki
0af4bdeb4de3a9f8cac5601c872cd4d9a7e9fb06a4fc0a7ed4fb60d6cb64b957
Loki
0dc69e491c783527c6465e25b8b33447391ae9d7ace6e4c1c20db8047aa1918a
Loki
0f6a0c8f4c9d3fa419bd22b2687328e7a721ad0b1ef504a64166b1c630997cee
Loki
16510508a55e331de91a5e246b4d0174a419203d557d7407861bf24a947ce16c
Loki
594a574211cffc47d78817221315092ab978403b71e1ff43922286ec9f60e188
Loki
79866667d5cd578a1c6eda54a748ff9d316fff39064eecd282bc2a9ad8a5ac7d
Loki
7f0fcb4f3651ec6a3b273322857afe8aa8373f77964afd0bb592378a4a97fe1a
Loki
a1f8dd874a1d63dfbd2cc504fbe6d5784eb00610b02fef44b606b7a127f41bc4
Loki
f3797cb6054ef9d5de1b4ecb2745424ef0481c5cb28ec2f2384d2591019e1650
Loki
+ 4'407 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:lokibot collection discovery downloader execution spyware stealer trojan
Link:
https://tria.ge/reports/240924-j81dssxclp/
Behaviour
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Command and Scripting Interpreter: PowerShell
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Blocklisted process makes network request
Guloader,Cloudeye
Lokibot
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6ff407811ce5f14f5302bcb2646e67946293cb333f6c8550801d80fea2af9ec1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_Malicious_VBScript_Base64
Create hunting rule
Author:daniyyell
Description:Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.
Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments