MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c26b896ec6d6aeeb8430321244816edb0910c928a3d2aa086283542a849b364. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c26b896ec6d6aeeb8430321244816edb0910c928a3d2aa086283542a849b364
SHA3-384 hash: b000a0186781311f3640b91dc0b123d10a63fecb114c25413c95b2f6f40e739d0f1a0185b802de67ad85dbdc54b4ee49
SHA1 hash: ea1d8318ba9c4fcce6651eb42342585444b30514
MD5 hash: b04726bf46166d1b502c952fc225b6af
humanhash: kilo-foxtrot-mango-violet
File name:Swift copy REF329001996045.xlsx
Download: download sample
Signature Loki
Create hunting rule
File size:1'067'228 bytes
First seen:2021-05-04 05:00:51 UTC
Last seen:2021-05-04 06:01:45 UTC
File type:Excel file xlsx
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 24576:rA6HIwliZRi58xPXh+mgk5eY8vHoLrP5y6jTS/eh/XQBm1:U64ZMYfm+ervHgrP86jTph/Xk6
TLSH EB35230BC9235D91D3F85E3925C35BD62C415A1FF3FBD574A9BB824CB2E92C2B242498
Reporter cocaman
Tags:CVE-2018-0802 INVOICE Loki SWIFT xlsx


Avatar
cocaman
Malicious email (T1566.001)
From: ""finance HQ" <postmaster@strusasu.com>" (likely spoofed)
Received: "from slot0.strusasu.com (slot0.strusasu.com [185.121.120.142]) "
Date: "Tue, 04 May 2021 04:00:25 +0100"
Subject: "FW:SWIFT COPY FOR INVOICE PAYMENT"
Attachment: "Swift copy REF329001996045.xlsx"

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE dump

MalwareBazaar was able to identify 10 sections in this file using oledump:

Section IDSection sizeSection name
A128007 bytesOle10Native
B177 bytesCompObj
B262 bytesOle
B31520900 bytesOle10Native
C1827992 bytesOLe10NaTIVe
C220 bytesOle
C30 bytes5vub7TY1ziWNQ2tOAl6xHJ74ahIqX

Intelligence

File Origin
# of uploads :
3
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
File type:
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
Has a screenshot:
False
Contains macros:
False
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/149675/
Detection(s):
TwinWave.EvilDoc.FormBookTopLoaderDancingInTheMoonLight.20210218.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EQAndMisCasedOleNativeWasTheCaseThatTheyGaveMe.20200215.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
DNS request
Sending a custom TCP request by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
OOXML Excel File with Embedding Objects
Link:
https://app.docguard.net/7c26b896ec6d6aeeb8430321244816edb0910c928a3d2aa086283542a849b364/results/dashboard
Document image
Image:
Download PNG
Document image
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/7c26b896ec6d6aeeb8430321244816edb0910c928a3d2aa086283542a849b364
Details
Document With No Content
Document contains little or no semantic information.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/709200
Signature
Document exploit detected (process start blacklist hit)
Injects files into Windows application
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7c26b896ec6d6aeeb8430321244816edb0910c928a3d2aa086283542a849b364/
Threat name:
Document-Office.Exploit.CVE-2018-0802
Create hunting rule
Status:
Malicious
First seen:
2021-05-04 02:46:19 UTC
File Type:
Document
Extracted files:
70
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210504-q2lgkr4qn6/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Launches Equation Editor
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
NSIS installer
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Uses the VBS compiler for execution
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Lokibot
Malware Config
C2 Extraction:
http://dyjcgvdfgdzgzdzzf.cf/Bn3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7c26b896ec6d6aeeb8430321244816edb0910c928a3d2aa086283542a849b364

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Excel file xlsx 7c26b896ec6d6aeeb8430321244816edb0910c928a3d2aa086283542a849b364

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/149675/

Comments