MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75692933366e01cb320075f6bcadce5fd2192a680c5671323851006561fd6fc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75692933366e01cb320075f6bcadce5fd2192a680c5671323851006561fd6fc4
SHA3-384 hash: beb566fa6d5de63d624c997473dfdf6450dbf6b68b9d43b5c195e8a88b864efbdae9d64c4435ddf8fb5316900d710b26
SHA1 hash: 7c2f52fc134f33553212c12005d8f0425cb738ef
MD5 hash: 19f1b8d8a07f83dbb8fc3b3520f1eaf9
humanhash: mountain-delaware-mockingbird-eight
File name:PO_00151896.exe
Download: download sample
Signature Loki
Create hunting rule
File size:455'336 bytes
First seen:2021-04-06 08:21:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:vFY2wxIHESG8Oyrqd92D0Z6m+vvkJgZSKux:vPwxQ3fy9m0B8vkJ3vx
Threatray 149 similar samples on MalwareBazaar
TLSH FEA412266F98E80BEA0A5E3825F2C32547B6FD51B91BD3039D35B2E88F357C87D06185
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail0.fycompanies.com
Sending IP: 165.232.171.148
From: Malar Reddy <sales@fycompanies.com>
Subject: Standard Purchase Order
Attachment: PO_00151896.rar (contains "PO_00151896.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO_00151896.exe
Verdict:
Suspicious activity
Analysis date:
2021-04-06 08:24:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/45dff882-4435-45b4-8189-c7a8d55f1c22

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/132636/
Detection(s):
SecuriteInfo.com.Artemis19F1B8D8A07F.31874.25417.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching a service
Deleting a recently created file
Sending a UDP request
Creating a file
Reading critical registry keys
Changing a file
Replacing files
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Enabling the 'hidden' option for recently created files
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Connection attempt to an infection source
Sending an HTTP POST request to an infection source
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/667317
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected aPLib compressed binary
Yara detected Costura Assembly Loader
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 382587 Sample: PO_00151896.exe Startdate: 06/04/2021 Architecture: WINDOWS Score: 100 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Multi AV Scanner detection for domain / URL 2->41 43 Found malware configuration 2->43 45 11 other signatures 2->45 7 PO_00151896.exe 15 6 2->7         started        process3 dnsIp4 35 takr.xyz 7->35 25 C:\Users\user\AppData\...\PO_00151896.exe, PE32 7->25 dropped 27 C:\Users\...\PO_00151896.exe:Zone.Identifier, ASCII 7->27 dropped 29 C:\Users\user\AppData\...\PO_00151896.exe.log, ASCII 7->29 dropped 31 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 7->31 dropped 47 Performs DNS queries to domains with low reputation 7->47 49 Writes to foreign memory regions 7->49 51 Injects a PE file into a foreign processes 7->51 12 PO_00151896.exe 54 7->12         started        16 AdvancedRun.exe 1 7->16         started        18 AdvancedRun.exe 1 7->18         started        file5 signatures6 process7 dnsIp8 37 takr.xyz 172.67.153.81, 49727, 49728, 49730 CLOUDFLARENETUS United States 12->37 53 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->53 55 Tries to steal Mail credentials (via file registry) 12->55 57 Tries to steal Mail credentials (via file access) 12->57 59 3 other signatures 12->59 20 AdvancedRun.exe 16->20         started        23 AdvancedRun.exe 18->23         started        signatures9 process10 dnsIp11 33 192.168.2.1 unknown unknown 20->33
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/75692933366e01cb320075f6bcadce5fd2192a680c5671323851006561fd6fc4/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 02:36:47 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ovussmzwnya4wmqaox3lzlool7jbsktibrlhcmrykeagkyp5n7ca._file
Verdict:
malicious
Similar samples:
126f752c7dec6c513804a0737e5d0a03cd8a1082923d68aec35979f3a7db7d60
Loki
1a2beaadeb5f9bc79af30c8a9e458bff69d4b481b305451afe68d0f1a9074da1
Loki
3afef4ab289c49f347ed065f4d272cec7ea413b5c84fb4c2e6aa9adad2716db6
Loki
49a4c95599f7bfe481ed85792ded20eae37d7a3889d43f81c349314cf87e6219
Loki
4dde8ce9768e8239201fd508ec359f26c1703ebcdf4147c5503b303bacecd727
Loki
5932fcc4c5d01a0d7667dfe1e6d10dd8c540b2ac57623c8c4b99dfdcd43cd63e
Loki
5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95
Loki
68a091c7eeb321aeb2734ae205bda995bc71c48338200d42ed334a7e0a34f495
Loki
9e6fdb6456dfaf737767adb44ebdb84910cec8be91a12c2b7a37c84b5aed6104
Loki
bcfcc5a278671fbe1b5f5f27c6d61921add83e57a0c61f80a165455b3fe0875a
Loki
+ 139 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210406-pwnxbsxkg2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Nirsoft
Lokibot
Malware Config
C2 Extraction:
http://takr.xyz/TAKR/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
cd57e145a2817d9ac9cd31b091489d61947473bae8890765be051335608f1fca
MD5 hash:
21fa4141b0eb353b92c1ab95c4faba54
SHA1 hash:
bbaf6d799c99bef15191a164fb6cc93911d85517
Link:
https://www.unpac.me/results/dbaa4204-e69a-4114-970d-e58ba9836397/
SH256 hash:
b38b6f2065c8e0370817976f746fb59c92a2c5b984ca67c0d153f7ae78dad934
MD5 hash:
36875359a0730ccb146dd78125d2f6c9
SHA1 hash:
b422ce7b5aaf9773a1acba6b2fcc4427bc751b96
Link:
https://www.unpac.me/results/dbaa4204-e69a-4114-970d-e58ba9836397/
SH256 hash:
3da80bd8e18bf2ef5e28f5e2e0d2095b0d4e65391800ce18f9a18859d7beb220
MD5 hash:
5dbed7594d4c8d71c1882692e6776bf0
SHA1 hash:
8552a2f2afca501945fe57c1875970b6f777f709
Link:
https://www.unpac.me/results/dbaa4204-e69a-4114-970d-e58ba9836397/
SH256 hash:
d14c7900e00546671f6635b957abf4a937550787561a96ed6161a95bee555d7f
MD5 hash:
ac2a906713828a341c5db26b5c3e8865
SHA1 hash:
1227f4718f3828e97ff1d06c7c68d4696a3a18d0
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/dbaa4204-e69a-4114-970d-e58ba9836397/
SH256 hash:
75692933366e01cb320075f6bcadce5fd2192a680c5671323851006561fd6fc4
MD5 hash:
19f1b8d8a07f83dbb8fc3b3520f1eaf9
SHA1 hash:
7c2f52fc134f33553212c12005d8f0425cb738ef
Link:
https://www.unpac.me/results/dbaa4204-e69a-4114-970d-e58ba9836397/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/75692933366e01cb320075f6bcadce5fd2192a680c5671323851006561fd6fc4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar cc591e2a3cc3074414ec853fdd991cb4b242c7f1df148edf275412ac82cf3fef

Loki

Executable exe 75692933366e01cb320075f6bcadce5fd2192a680c5671323851006561fd6fc4

(this sample)

  
Dropped by
MD5 f7c04f1c766465c9bf733d19143acf78
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 cc591e2a3cc3074414ec853fdd991cb4b242c7f1df148edf275412ac82cf3fef
Cape
Cape
https://www.capesandbox.com/analysis/132636/

Comments