MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78f342372865460fa2db1124046e6eb93b89a0a24dda0c28946a36569af5f1c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78f342372865460fa2db1124046e6eb93b89a0a24dda0c28946a36569af5f1c9
SHA3-384 hash: 63ef860b538bbe78f89b96a0e3125fb56008093b5f0cc518095db3191bf9e7bfe74d8889219a7df986db474b428d0ed6
SHA1 hash: fdb45931681ec25c149816e0ab92e9482e20f119
MD5 hash: 8480b7a266e9b9659e29c8178269e822
humanhash: wyoming-washington-alaska-sixteen
File name:Bank Details.pdf_________________________.gz
Download: download sample
Signature Loki
Create hunting rule
File size:568'261 bytes
First seen:2021-08-14 09:14:38 UTC
Last seen:2021-08-14 09:15:19 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:3yN5yf5GnDmkiqUTJvWlmo5YFdCdAm3iUobxLSXjL3sJQRhaqNG:3yNhDmFJgB2F0r1jbsUaYG
TLSH T175C433AA6501504AAF03C8F88449B94DC3BD49977FD7CC738A36A33863F5B54B68B5D0
Reporter cocaman
Tags:gz Loki


Avatar
cocaman
Malicious email (T1566.001)
From: "MAURICIO PENAGOS <mpenagos@dominosgda.com>" (likely spoofed)
Received: "from vps.fretol.com (slot0.fretol.com [212.193.30.140]) "
Date: "Fri, 13 Aug 2021 06:00:54 -0700"
Subject: "Aviso de pago - Ref. Aviso[G1117599144] / Pago prioritario."
Attachment: "Bank Details.pdf_________________________.gz"

Intelligence

File Origin
# of uploads :
2
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78f342372865460fa2db1124046e6eb93b89a0a24dda0c28946a36569af5f1c9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-13 15:46:08 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
15 of 46 (32.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pdzuenzimvda7iw3cesai3toxe5ytifcjxnaykeuni3fngxv6heq._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer suricata trojan
Link:
https://tria.ge/reports/210814-zw5dmfdwv2/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://aboasu.xyz/dx/kk/koo.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/78f342372865460fa2db1124046e6eb93b89a0a24dda0c28946a36569af5f1c9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

gz 78f342372865460fa2db1124046e6eb93b89a0a24dda0c28946a36569af5f1c9

(this sample)

Loki

Executable exe ac8ab6d26de41ba63cd9fab6732dc4e08a5ce16d6ba9b747a585c56ee02ade40

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ac8ab6d26de41ba63cd9fab6732dc4e08a5ce16d6ba9b747a585c56ee02ade40
  
Dropping
Loki

Comments