MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77efe5a35f94f065b20860f7e446432d9c61fd6b139b1f4cd360a5a728f49410. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 11

Intelligence 11 IOCs YARA 12 File information Comments

SHA256 hash:	77efe5a35f94f065b20860f7e446432d9c61fd6b139b1f4cd360a5a728f49410
SHA3-384 hash:	dccd4c6e2eb35f565c38d956c3a2a9caa4e41ef31f32cb215c793f536c62b41bc8c98d882b17df7d66900089befe0eb0
SHA1 hash:	2af0e521c34cf7eaae8677e593900024fe0d16c9
MD5 hash:	2559b5b8d60dd663df52d0570f5973a9
humanhash:	magnesium-triple-pizza-utah
File name:	2559b5b8d60dd663df52d0570f5973a9.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	269'312 bytes
First seen:	2021-02-16 20:02:58 UTC
Last seen:	2021-02-16 21:54:33 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	84bd49391b651e0c3ce957eba4303b71 (1 x Loki, 1 x Amadey)
ssdeep	6144:T1wUIRkrbJzmFuERDOm+dwclg+8Iy+8Cl9Tf6BxUemJ:T1ORkr1CFuERD9+yb+R8k9TS79mJ
Threatray	2'490 similar samples on MalwareBazaar
TLSH	40447D10A7A0C435F6B716F8487A83BCA52D7E715F2151CB92D92AEA5E347E0EC3134B
Reporter	abuse_ch
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

130

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

http://stdyrusschinetwomast.dns.army/receiprt/regasm.exe

Verdict:

Malicious activity

Analysis date:

2021-02-16 05:31:58 UTC

Tags:

trojan lokibot stealer

Link:

https://app.any.run/tasks/993930c7-f72d-4028-af9a-3c4e8e1f9a83

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/117433/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.36355981.32244.14796.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Reading critical registry keys

Changing a file

Replacing files

DNS request

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Sending a UDP request

Stealing user critical data

Connection attempt to an infection source

Moving of the original file

Sending an HTTP POST request to an infection source

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/609452

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/77efe5a35f94f065b20860f7e446432d9c61fd6b139b1f4cd360a5a728f49410/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-02-16 05:45:48 UTC

AV detection:

21 of 28 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=o7x6li27styglmqimd36irsdfwogd7llconr6tgtmcs2okhusqia._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Unpacked files

SH256 hash:

3dd20568953a74f24c48e35051e19be3f5bf90daecede4061b5d6ab4295ec447

MD5 hash:

aea452d120aa78ae3f6436a75429f331

SHA1 hash:

5bc3075099e6ad2a0c046fc2dc5eed2cb6a59078

Detections:

win_lokipws_g0

win_lokipws_auto

Link:

https://www.unpac.me/results/fdae6551-984c-4d0d-92dc-535bb1930243/

Parent samples :

9fa8a1b38d3ce7e129270292b37bc4a9b750d96232bd0bd0b71d192756c6bc37
77efe5a35f94f065b20860f7e446432d9c61fd6b139b1f4cd360a5a728f49410

SH256 hash:

77efe5a35f94f065b20860f7e446432d9c61fd6b139b1f4cd360a5a728f49410

MD5 hash:

2559b5b8d60dd663df52d0570f5973a9

SHA1 hash:

2af0e521c34cf7eaae8677e593900024fe0d16c9

Link:

https://www.unpac.me/results/fdae6551-984c-4d0d-92dc-535bb1930243/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/77efe5a35f94f065b20860f7e446432d9c61fd6b139b1f4cd360a5a728f49410

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	SUSP_XORed_URL_in_EXE Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com