MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72e8b3fd24829835385355fcc25e832e71b2303a730f06c95c97b4227176baa2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments

SHA256 hash:	72e8b3fd24829835385355fcc25e832e71b2303a730f06c95c97b4227176baa2
SHA3-384 hash:	e38ec0c33ab9357d7a06ae70c0c61695b87ab00c64d0dc86de8482087fd272e4e2879e785fdcdf2dfe1ab8448f577f0b
SHA1 hash:	07e114eca3744a6d9bc941d0b17ddaf5fd353b28
MD5 hash:	b2253d7d83e98e13d346d8f5b59be824
humanhash:	three-whiskey-lion-fanta
File name:	Recibo TNT_pdf.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	667'136 bytes
First seen:	2020-10-13 05:54:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	010f3e42f15e9eb57a4a9a1dad838a51 (10 x Loki, 8 x AgentTesla, 3 x MassLogger)
ssdeep	12288:EAindXhz+XwfE0CQPW7q0dzQNqJHRrUtqOD29wJmVMD:Li16wf9aNzQ4lFUtqE2Kf
Threatray	1'599 similar samples on MalwareBazaar
TLSH	CDE4AE22E2E17433C1373A3D9EDB57EC982DBE502D2869462BE51C4F5F3D691342A293
Reporter	abuse_ch
Tags:	BRA exe geo Loki TNT

abuse_ch

Malspam distributing Loki:

HELO: mail.mozadom.ga
Sending IP: 168.235.109.227
From: NOTIFICAÇÃO DE REMESSA TNT <noreply@tnt.br>
Subject: NOTIFICAÇÃO DE REMESSA TNT
Attachment: Recibo TNT_pdf.z (contains "Recibo TNT_pdf.exe")

Loki C2:
http://195.69.140.147/.op/cr.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/70267/

Detection(s):

Win.Malware.Generic-9777076-0

Win.Malware.Generic-9777168-0

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Reading critical registry keys

Sending a UDP request

Changing a file

Replacing files

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Stealing user critical data

Connection attempt to an infection source

Moving of the original file

Sending an HTTP POST request to an infection source

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/489205

Signature

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/72e8b3fd24829835385355fcc25e832e71b2303a730f06c95c97b4227176baa2/

Threat name:

Win32.Trojan.CryptInject

Status:

Malicious

First seen:

2020-10-12 22:19:45 UTC

AV detection:

24 of 48 (50.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=olulh7jeqkmdkoctkx6mexudfzy3emb2omhqnsk4s62ce4lwxkra._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

spyware trojan stealer family:lokibot

Link:

https://tria.ge/reports/201013-vvpyvplj46/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://195.69.140.147/.op/cr.php/qq0L3SAjvtmMY
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php