MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fa734ae8d4dd945ab53df6bc39a42134e91411aa06ea0bdda0425e7c60911c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fa734ae8d4dd945ab53df6bc39a42134e91411aa06ea0bdda0425e7c60911c6
SHA3-384 hash: daa08b490a8da5507be555b5f0bf1306521a7a86ed851ed871351690cfc4c169920631a03633f8ff22ff95d7856bc03a
SHA1 hash: 31eb34506795bc6d2c2affcea22677eec669b03a
MD5 hash: eb837b7371e9e587961130c9fda9cf0c
humanhash: california-fillet-grey-alpha
File name:payment kovo.exe
Download: download sample
Signature Loki
Create hunting rule
File size:346'624 bytes
First seen:2020-06-23 05:52:45 UTC
Last seen:2020-06-23 07:01:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 390e29859a8109da4988860f226bf922 (5 x AgentTesla, 4 x Loki, 1 x NanoCore)
ssdeep 6144:/ujNTo2ybezRH7WdHitmi7zXkVKml6gL7fU4LjZ01xo8ttrRLg0fhBq:/SToRClCCIiXXkVdFL7fZjZ01xo8Trux
Threatray 1'494 similar samples on MalwareBazaar
TLSH 207402AADB448C75C61C597305174B658348E422A83BDF032AD0EE4DF879DCFAF4EA58
Reporter jarumlus

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12807/
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7fa734ae8d4dd945ab53df6bc39a42134e91411aa06ea0bdda0425e7c60911c6/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-23 05:54:06 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p6ttjlunjxmulk2t35v4hgsccnhjcqi2ubxkbpo2aqs6prqjchda._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
093261263ec2d1ec3042f09400aa7aa6e2963fca22089bec1718bddd80225673
Loki
38605c9b483d95d6729af644ff2338d10d2b6714012c4299a083988e5739387b
Loki
3968f76530e5c9471adb0a30c06159c939f59538a27fb9e9c508857de42fc1b5
Loki
4311521a696874a86ea0e4dcecbbd6936ef077955bb85659ea1552515b6e6da0
Loki
771e24bf597185ef9c18a2b45b018773c4128f4a80fab40b5cd6d00bcce16f99
Loki
8365241d902a7196708f6ba21b1438661ac1ea2618b8046bfe8a742e1403106b
Loki
9332d033a54d5c11bb1115012e5cd8e1a08efdf242784ccad6cbeded2f57e1d0
Loki
9ed49839f97c5bd2844562286ae50e5ccf1dcf6d0b47399d857f4fd8671c01db
Loki
b494bc7c282b57a3d9dc02d6d3ad8430dc965465cb17fe43acde2874f7266465
Loki
e1303b3fa517337cb6c5724fb6c2dfb66cbe7a9ab93b0b7286a0972c51278bc5
Loki
+ 1'484 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
spyware trojan stealer family:lokibot
Link:
https://tria.ge/reports/200624-fktlplf2ts/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: RenamesItself
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
https://nnasout.com/loo/need/work/Panel/five/fre.php?
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

48ed6c94d98672a6d2f33dd7b3b6feb8a2c086486b4c1b9f69aba5c720ff0a06

Loki

Executable exe 7fa734ae8d4dd945ab53df6bc39a42134e91411aa06ea0bdda0425e7c60911c6

(this sample)

  
Dropped by
MD5 221238aca6eeb877e47c3c6ebc2af39b
  
Dropped by
SHA256 48ed6c94d98672a6d2f33dd7b3b6feb8a2c086486b4c1b9f69aba5c720ff0a06
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/12807/

Comments