MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 792259d9e6e262d17cc54f4b43c8e95cd0be1e533f5e5032a5cdefb9f899a6a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 10

Intelligence 10 IOCs YARA 5 File information Comments

SHA256 hash:	792259d9e6e262d17cc54f4b43c8e95cd0be1e533f5e5032a5cdefb9f899a6a2
SHA3-384 hash:	3dc7d322805df5f912059e5dc542c6d31eef50173c23904b7c78963c0f4da6c3769cf625f37a6aada8d56495e601926b
SHA1 hash:	b1ce1be89f25c469701ec67ccec7dcb694c7a4a8
MD5 hash:	e4d31d9bffe88f21edc58fbf83bc0d69
humanhash:	juliet-march-cardinal-hawaii
File name:	PO.W424676.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	717'312 bytes
First seen:	2020-10-12 06:15:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:hKTOLPR+5QuQGkQcmuI6Klxqd70UTbZAEhFFbFByZ/EVfpgIiue:/Lw5lQGXcmuId07hbdhbbFB+/EVfque
Threatray	1'585 similar samples on MalwareBazaar
TLSH	F3E4E06137F99F86E1BD8BF91264115043F93A1B382EE60D2DC269DF2AB5F418210F67
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Malspam distributing Loki:

HELO: server.filmworld.tv
Sending IP: 70.32.31.17
From: Lift Freight Services <lfsrtn.sales@liftfreight.com>
Reply-To: webbymas@yahoo.com
Subject: NEED NEW TAX INVOICE PO#140797
Attachment: PO.W424676.rar (contains "PO.W424676.exe")

Loki C2:
http://linkk-my.com/kaka/kaka5/fre.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/69950/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Unauthorized injection to a recently created process

Creating a file

Reading critical registry keys

Changing a file

Replacing files

DNS request

Stealing user critical data

Connection attempt to an infection source

Sending an HTTP POST request to an infection source

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/488019

Signature

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected AntiVM_3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/792259d9e6e262d17cc54f4b43c8e95cd0be1e533f5e5032a5cdefb9f899a6a2/

Threat name:

ByteCode-MSIL.Trojan.Sudloader

Status:

Malicious

First seen:

2020-10-12 03:50:18 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=perftwpg4jrnc7gfj5fuhshjltil4hsth5pfamvfzxx3t6ezu2ra._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

spyware trojan stealer family:lokibot

Link:

https://tria.ge/reports/201012-qschf4nmw2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://linkk-my.com/kaka/kaka5/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

d4e464a0bdc36aceee40f9527ee0bf4211d34a4fd135af2711a51f23687071a0

MD5 hash:

a9d736a3a747494e2826bfa51ba2ce4c

SHA1 hash:

6983da664f037719513832e7e46701ca01c6af13

Detections:

win_lokipws_g0

win_lokipws_auto

Link:

https://www.unpac.me/results/9257aab8-576a-4b11-a2e9-97f014ad0b01/

Parent samples :

792259d9e6e262d17cc54f4b43c8e95cd0be1e533f5e5032a5cdefb9f899a6a2
e0693087d46213280ce4281058ff53b07f433a9b07f4eaebf41314dd724f8e73

SH256 hash:

607f04646c9f16f7c23fa69d4b8f660fc7c44d40e4f73a0c70a2b315debdaa8b

MD5 hash:

a90baadadf904455325f7bc787185c7b

SHA1 hash:

7d833bb819d638008c98be469b05db2feaf201cd

Link:

https://www.unpac.me/results/9257aab8-576a-4b11-a2e9-97f014ad0b01/

SH256 hash:

ec349dad0cf5ed386155b64797e99e127f7673aea3ccbc55cac9ac128f4bb74f

MD5 hash:

1b1bd6b019e7a1a5e95cb329fa6efb9a

SHA1 hash:

8690dd9712017fa9128aa049a576ef71df883c9c

Link:

https://www.unpac.me/results/9257aab8-576a-4b11-a2e9-97f014ad0b01/

SH256 hash:

792259d9e6e262d17cc54f4b43c8e95cd0be1e533f5e5032a5cdefb9f899a6a2

MD5 hash:

e4d31d9bffe88f21edc58fbf83bc0d69

SHA1 hash:

b1ce1be89f25c469701ec67ccec7dcb694c7a4a8

Link:

https://www.unpac.me/results/9257aab8-576a-4b11-a2e9-97f014ad0b01/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.65

Link:

https://yomi.yoroi.company/submissions/792259d9e6e262d17cc54f4b43c8e95cd0be1e533f5e5032a5cdefb9f899a6a2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com