MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75a36cc751a8d0dd41ef2aa50ca1f4b631071e9cb63c44b2bb98d660f425c27f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	75a36cc751a8d0dd41ef2aa50ca1f4b631071e9cb63c44b2bb98d660f425c27f
SHA3-384 hash:	df579ca8c537a8553f7ac92399b8856ebee58c01becb97024abfc0022117da49ab4e6ccd2b70e9d8e86245e6672afe4b
SHA1 hash:	07b76299dd7b6767af8b0b46c95294521774dbcc
MD5 hash:	4a84ebb1e833007f353ae29cf685e7af
humanhash:	michigan-solar-six-wolfram
File name:	New Order.iso
Download:	download sample
Signature	Loki Create hunting rule
File size:	1'703'936 bytes
First seen:	2021-07-13 04:56:19 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	24576:48tb1tszuqvCiGh9yA7zg0n5f9l6PIYpbjb6:4abfszuqaiJ4D5FcxbH
TLSH	T1CC75AE2823FDA509F237FF709F60F2458EA6BB769225C54D68C4120A6871D81FEB7532
Reporter	cocaman
Tags:	iso Loki

cocaman

Malicious email (T1566.001)
From: "ympark@paseco.co.kr" (likely spoofed)
Received: "from paseco.co.kr (unknown [103.155.80.90]) "
Date: "12 Jul 2021 07:55:51 -0700"
Subject: "Re:Re:Schedule IMG. Order No.3352004038 With Details"
Attachment: "New Order.iso"

Intelligence

File Origin

# of uploads :

# of downloads :

117

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.925-1.UNOFFICIAL

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/75a36cc751a8d0dd41ef2aa50ca1f4b631071e9cb63c44b2bb98d660f425c27f/

Threat name:

ByteCode-MSIL.Backdoor.Androm

Status:

Malicious

First seen:

2021-07-12 18:20:15 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

8 of 29 (27.59%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=owrwzr2rvdin2qppfksqzipuwyyqohu4wy6ejmv3tdlgb5bfyj7q._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/210713-4q7rj5rqxx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Lokibot

Malware Config

C2 Extraction:

http://185.227.139.18/dsaicosaicasdi.php/auJMYiGBL7JHG
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/75a36cc751a8d0dd41ef2aa50ca1f4b631071e9cb63c44b2bb98d660f425c27f