MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71375c424ff84c8a5935120652e8904e508d8f61ea490517c6d191fb4e99ee7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 18


Intelligence 18 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 71375c424ff84c8a5935120652e8904e508d8f61ea490517c6d191fb4e99ee7a
SHA3-384 hash: 94ec43226165629969e6710d0987bf6d17186eed3a3bb0d8c522e9dba63f474f534ddfb3c28322287eda568ada76e40e
SHA1 hash: 767e8fde64a2e0651f3ae6731b00df4d9d57d2a9
MD5 hash: 08c12f006548f1db633b2db2dc2c99d5
humanhash: cold-burger-mango-emma
File name:SecuriteInfo.com.Win32.KeyloggerX-gen.30873.17396
Download: download sample
Signature Loki
Create hunting rule
File size:609'792 bytes
First seen:2023-09-26 05:45:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:H0WWObWyRpsds6JqN4RuD/8IPC7RG5q9MZS0Nw3ajrKlyW:U4xp+JPI6dUq9gK3bly
Threatray 3'808 similar samples on MalwareBazaar
TLSH T18BD402A672F887AAD55D40B8883551150F7329573421C3A9B8DEB0FE4FE63421B06FBB
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 61ccae5d69b28c61 (9 x AgentTesla, 6 x Loki, 2 x SnakeKeylogger)
Reporter SecuriteInfoCom
Tags:exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
344
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.KeyloggerX-gen.30873.17396
Verdict:
Malicious activity
Analysis date:
2023-09-26 05:49:00 UTC
Tags:
trojan lokibot
Link:
https://app.any.run/tasks/a7d01985-65e3-4a67-8edb-638da92dd2f9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/451150/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Win32.KeyloggerX-gen.30873.17396.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Reading critical registry keys
Changing a file
DNS request
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for analyzed file
Stealing user critical data
Moving of the original file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lokibot packed
Link:
https://www.filescan.io/uploads/6512701c33582f234e0340da/reports/8ab95267-a2ef-4b4c-aaf9-06be1f669f06/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/71375c424ff84c8a5935120652e8904e508d8f61ea490517c6d191fb4e99ee7a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2c996b3e-c7b7-4787-a296-fab1812144a8
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1314260
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/71375c424ff84c8a5935120652e8904e508d8f61ea490517c6d191fb4e99ee7a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-09-26 03:50:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
15 of 23 (65.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oe3vyqsp7bgiuwjvcidff2eqjzii3d3b5jeqkf6g2gi7wtuz5z5a._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
04322d8af3fe7d7ba8c91fd9c076c7b7a71f216859cf6a33cbfda968cfaf6581
Loki
13b7f376d27ce6de51165613f7faf54350e0fbd2c50b509df1bdc3704e26808f
Loki
5c8cebda365a042d04dc1734322b809fdb56e95f0a7ce0b7bd3e141ebccc07bf
Loki
78a5a0b0bed684217ba65ee4f92daebaa0ef82c9f95d9a5999e0b3755e2ba823
Loki
7e44c6fb6963620960fe0f8574af42ec032aaff7238bf470cba2c4af3a9da77d
Loki
aa5db1e76d992d81c9b6f368bc705f4240512bc4aa193cc23fa3ba50ce48d1fc
Loki
c4359763aa0cac9b3d55b130cca1f38e1a4b3a2b80c55feff4e048b86d2e9c0f
Loki
e2de9b40fe4d786cefc62428bb7e17d2268f5bf6c8c939e576d86be69c90af90
Loki
e3bd0660f61bc671f91a00cac1734dd1854d7c7a2ae4293ddc960d274fdfbe6e
Loki
fa2e13816b82a6b02a6b4c92c43da4cee9c73a89b7c60efef7bf3446dfd75db6
Loki
+ 3'798 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/230926-ggayqafa3v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://zsin1.andrebadi.top/_errorpages/zsin1/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
8166edc6402990e60b92312dd5e6347d8579bfff3958e37bed5cebc316705c5b
MD5 hash:
5cad89fc586f13bd55a4788c995ec3d9
SHA1 hash:
e767585176f1a7ca61ca7a8b732f791a4f883c45
Link:
https://www.unpac.me/results/7b3c162e-e0e0-4d98-94dd-e264d6d22c61/
SH256 hash:
43aa60ccfec352d88a80647f5f259d0c92a184bb5fc43b24b5f166307207508a
MD5 hash:
3cb46841e693faa06a09ee5920767844
SHA1 hash:
81780b862e0f8ddd3356455becebb48ae9730329
Link:
https://www.unpac.me/results/7b3c162e-e0e0-4d98-94dd-e264d6d22c61/
SH256 hash:
2f3a256a026f1fad8f02f7bd633896fc795a5fffdfa5154ef119d77d9e6231c5
MD5 hash:
1d277100a975dca7bcaa319009e50188
SHA1 hash:
30e2348e2b0e577a8dd5b62872dbf8df19c6443b
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
Link:
https://www.unpac.me/results/7b3c162e-e0e0-4d98-94dd-e264d6d22c61/
Parent samples :
9e257acbd8180ed78fa998c2b6f3e69cc563d6f70066c8dbf1165d9a8b95f715
71375c424ff84c8a5935120652e8904e508d8f61ea490517c6d191fb4e99ee7a
SH256 hash:
7ec118e70613ce2d9aee29cda2918ca710dde346c68d4da75c2ea0402e6d4391
MD5 hash:
1622a62bf6805b2dca82a8632eceac71
SHA1 hash:
071b72a5a1231149dfe4b9fcfa3a6ee49265ab7c
Link:
https://www.unpac.me/results/7b3c162e-e0e0-4d98-94dd-e264d6d22c61/
SH256 hash:
71375c424ff84c8a5935120652e8904e508d8f61ea490517c6d191fb4e99ee7a
MD5 hash:
08c12f006548f1db633b2db2dc2c99d5
SHA1 hash:
767e8fde64a2e0651f3ae6731b00df4d9d57d2a9
Link:
https://www.unpac.me/results/7b3c162e-e0e0-4d98-94dd-e264d6d22c61/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/71375c424ff8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/71375c424ff84c8a5935120652e8904e508d8f61ea490517c6d191fb4e99ee7a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/451150/

Comments