MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 786b8f864e20d1d540b166d6a1d4432cefca4c9ac54211642a5d0db8cca3372d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 8


Intelligence 8 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 786b8f864e20d1d540b166d6a1d4432cefca4c9ac54211642a5d0db8cca3372d
SHA3-384 hash: 8d56d2abe80ca2dc7c9883e33c849853bc475e3ac74bfa66eaeb23f647e54eabe2200036c9ba51ea916d2987779f29a0
SHA1 hash: 8ed745db29dc5e230e4cf4e76fbf5c592076852b
MD5 hash: 6ac6ed57a87141fa7b642d473a6365e7
humanhash: kentucky-hawaii-alabama-quiet
File name:gunzipped.exe
Download: download sample
Signature Loki
Create hunting rule
File size:1'025'536 bytes
First seen:2021-04-20 05:40:17 UTC
Last seen:2021-04-20 07:13:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:2nHROBOobXIRRRRRB96Do5/GhmTyA9MuG7zk:2nHE3bXIRRRRRqchGpA9SP
TLSH 3F25BF257FD5DED4D27A4B784CB4B21493F9BC118E1BCA0AAEA135DC5A30FC45A3224E
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://51.195.53.221/p.php/vTJFuMJc5Kr48

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://51.195.53.221/p.php/vTJFuMJc5Kr48 https://threatfox.abuse.ch/ioc/9181/

Intelligence

File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
gunzipped.exe
Verdict:
Malicious activity
Analysis date:
2021-04-20 06:59:51 UTC
Tags:
trojan lokibot stealer
Link:
https://app.any.run/tasks/b9041251-c6f0-48b4-938a-0db82364c719

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Strictor.256678.22686.4378.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/688270
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/786b8f864e20d1d540b166d6a1d4432cefca4c9ac54211642a5d0db8cca3372d/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pbvy7bsoedi5kqfrm3lkdvcdftx4ute2yvbbczbklug3rtfdg4wq._file
Verdict:
unknown
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210420-bmgy1yzce2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://51.195.53.221/p.php/vTJFuMJc5Kr48
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/786b8f864e20d1d540b166d6a1d4432cefca4c9ac54211642a5d0db8cca3372d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments