MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7753866d897d906a36b96fa3b73c2a53e1367fabb1b16a61aa8b14cd9e65a4fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 12


Intelligence 12 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7753866d897d906a36b96fa3b73c2a53e1367fabb1b16a61aa8b14cd9e65a4fe
SHA3-384 hash: 945691c4e1eb3f78188e258ca861dabf5e7b62ab8e1e1a9a536671f5ecd1c54764dd3ab1e9d2f56d43466f3420646c6a
SHA1 hash: 3eb2f3a7163fce6b0f3442eb09a321cf6287a42b
MD5 hash: 3fcd90740d602891b8c2aa9fc2b62053
humanhash: september-pluto-arizona-happy
File name:Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe
Download: download sample
Signature Loki
Create hunting rule
File size:432'128 bytes
First seen:2020-12-09 14:27:17 UTC
Last seen:2020-12-09 15:41:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:rVTOQlhu6iBjUuzU6L8/xcoVeC3TSt+zcIQgeQaRtu01r+MZTtigyZbQ7Ac:NuxdTzNL8fVzcDgeQaRdJ++Tt0c
Threatray 17 similar samples on MalwareBazaar
TLSH ED94D03221557F66EA7D4BF0D12124001FB4AF275221E64EBCC160EB22BF771BA51EA7
Reporter James_inthe_box
Tags:exe Loki

Intelligence

File Origin
# of uploads :
2
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe
Verdict:
Malicious activity
Analysis date:
2020-12-09 14:34:16 UTC
Tags:
trojan lokibot opendir
Link:
https://app.any.run/tasks/475a0c0c-dca1-4d98-a1b5-41a0ce64b097

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/107485/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.21240.7991.21740.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a file
Reading critical registry keys
Changing a file
Replacing files
DNS request
Connection attempt
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Stealing user critical data
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/559149
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses process hollowing technique
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 328672 Sample: Uy-RFQ-12-20-Tgroup.xlsX.xl... Startdate: 09/12/2020 Architecture: WINDOWS Score: 100 29 tuandat-vn.com 2->29 35 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->35 37 Multi AV Scanner detection for domain / URL 2->37 39 Found malware configuration 2->39 41 13 other signatures 2->41 8 Uy-RFQ-12-20-Tgroup.xlsX.xls.jpeg.exe 6 2->8         started        signatures3 process4 file5 21 C:\Users\user\AppData\Roaming\DzfGNHV.exe, PE32 8->21 dropped 23 C:\Users\user\AppData\Local\...\tmp751F.tmp, XML 8->23 dropped 25 Uy-RFQ-12-20-Tgrou...sX.xls.jpeg.exe.log, ASCII 8->25 dropped 43 Writes to foreign memory regions 8->43 45 Allocates memory in foreign processes 8->45 47 Sample uses process hollowing technique 8->47 49 Injects a PE file into a foreign processes 8->49 12 vbc.exe 55 8->12         started        17 schtasks.exe 1 8->17         started        signatures6 process7 dnsIp8 31 tuandat-vn.com 137.59.52.154, 49745, 49746, 49747 EMAXGLOBAL-ASEMAXGLOBALMEDIAPVTLTDIN India 12->31 33 192.168.2.1 unknown unknown 12->33 27 C:\Users\user\AppData\Roaming\...\B52B3F.exe, PE32 12->27 dropped 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->51 53 Tries to steal Mail credentials (via file registry) 12->53 55 Tries to steal Mail credentials (via file access) 12->55 57 2 other signatures 12->57 19 conhost.exe 17->19         started        file9 signatures10 process11
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7753866d897d906a36b96fa3b73c2a53e1367fabb1b16a61aa8b14cd9e65a4fe/
Threat name:
Win32.Trojan.OutBreak
Create hunting rule
Status:
Malicious
First seen:
2020-12-09 04:31:03 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o5jym3mjpwigunvzn6r3opbkkpqtm75lwgywuynkrmkm3htfut7a._file
Verdict:
unknown
Similar samples:
3bbed2bec4921aca55a13e5ccf12147bb43f164a915e9b1b0a0bfb9a54954409
Loki
4b7f3dd2d5f108a5479549dc729ff56a75edd171899c239b541581edba007d0f
Loki
5937bc1b0a10214a09f0bd7fd6987d42bba86748ce52bca41adfd8c7021ca6bd
Loki
72bff15d43e54772c639f876fbd6b132310081c87a9d997c4b0b3c08d09caf9f
Loki
875aea5b79d8765ad4b6637618d5dfa3c6f99b4f0660c08c31343f0996dffd07
Loki
8c26bff4e14c534089c565e1623fbdb1109285fa768e19e48fbde2d656358d4f
Loki
8dd80fcf3dfd0cbc6c82a1f9154ed99e2cb6fea34d1384289f5a40064f207720
Loki
c5cc30ea5b9f4701271672d38c1199c0e9bcc8db08aabd8addc1c92a36b248fc
Loki
f2b42eb3928d053d687ed2b8e81948972ba452d2e5eac013a32f55a71e1ff2b9
Loki
f36eeb335a9d18ff16f6b1869f45a0f81d44f93706fd2d39d4568d8d2e694ca3
Loki
+ 7 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/201209-mpxt1wp2l6/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Uses the VBS compiler for execution
Lokibot
Malware Config
C2 Extraction:
http://tuandat-vn.com/llz/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
7753866d897d906a36b96fa3b73c2a53e1367fabb1b16a61aa8b14cd9e65a4fe
MD5 hash:
3fcd90740d602891b8c2aa9fc2b62053
SHA1 hash:
3eb2f3a7163fce6b0f3442eb09a321cf6287a42b
Link:
https://www.unpac.me/results/54479ed3-e720-4ecf-a580-b5111fbae3f0/
SH256 hash:
d5974d5e9dc42c2bd65779fa2b04222db18dc4120c6e3ef993fc0512bc2265f7
MD5 hash:
be2fe3155343dd9d27f7c82c746d7d48
SHA1 hash:
1af211250efe3350882d7c8020f386332e3eb0fd
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/54479ed3-e720-4ecf-a580-b5111fbae3f0/
Parent samples :
ca6c0702ac45a81d1971f4411e553a85a5372c21d38638e5af8322f5605120f3
7753866d897d906a36b96fa3b73c2a53e1367fabb1b16a61aa8b14cd9e65a4fe
8733acdd1d6cefd0a4cdcdf04249ad06690fe0335055f3e8f6fd914ec23434ae
8df6cbe2123dfeac80e2af6a18935574bab1dbf3c2573cca5900bf202415eb2e
297f09f72357f0a75ff766bcabd71d604b9c657c9e6a4666dbe6a9692246eae2
94fad6ab9bc344630eed1bfe1c545394a4a66a2281334a2fe9f16b2b9206707f
SH256 hash:
c88a66cbf00b12c88e2b970b8bc220e970e8465e56098ced24e97d42be901b94
MD5 hash:
a60401dc02ff4f3250a749965097e13f
SHA1 hash:
3f22d28fd765f831084cb972a8bd071e421c26a1
Link:
https://www.unpac.me/results/54479ed3-e720-4ecf-a580-b5111fbae3f0/
SH256 hash:
4531c203bd89d508d81c870a73899cac7947c3b0f9dcd70db77f42eb6c16d426
MD5 hash:
b34b0d36e7fe148fd78791745d1fbcf9
SHA1 hash:
d89c386cd3d6e6abcbfcb6511a03f82e1cd62cb9
Link:
https://www.unpac.me/results/54479ed3-e720-4ecf-a580-b5111fbae3f0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7753866d897d906a36b96fa3b73c2a53e1367fabb1b16a61aa8b14cd9e65a4fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/107485/

Comments