MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81c772e7c3443e928084c9c25b4b7a31002dbac9c4c977eeace73dd721243317. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81c772e7c3443e928084c9c25b4b7a31002dbac9c4c977eeace73dd721243317
SHA3-384 hash: 1e4446549e4b8cd12fa2a9f53f77788a92061067842564de982a7f2b967b95a41a893ed921edc6567c42512d5211f814
SHA1 hash: 1f70c7daa4b2bee51f7a5e2a7315a8c54b606700
MD5 hash: 6c0c7128e3673edf9a8fb128a45a319e
humanhash: wisconsin-glucose-skylark-magnesium
File name:po.exe
Download: download sample
Signature Loki
Create hunting rule
File size:548'352 bytes
First seen:2021-05-03 05:39:23 UTC
Last seen:2021-05-03 06:02:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:RFE8eck9Fteo86HiBADJuSxRvi1W8rLZ2S9duH:q1D2VIr
Threatray 2'933 similar samples on MalwareBazaar
TLSH CCC4AE1D7BE16E98D5680E32EA6700D483F092676131F7EF25C41AE1DE4230B976F86B
Reporter abuse_ch
Tags:exe Loki

Intelligence

File Origin
# of uploads :
2
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/148166/
Detection(s):
SecuriteInfo.com.Artemis6C0C7128E367.11199.17037.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Deleting a recently created file
Creating a file
DNS request
Sending a custom TCP request
Sending a UDP request
Creating a window
Creating a process from a recently created file
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/707595
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/81c772e7c3443e928084c9c25b4b7a31002dbac9c4c977eeace73dd721243317/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-05-02 22:55:24 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qhdxfz6diq7jfaeezhbfws32geac3owjytexp3vm4465oijegmlq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
0ecfbf08398e1d0470c2f4d40a490808bd1b177cb60d674c5459d85f242952ab
Loki
2c151e8a462558e66b1cfd1a84fc7348d145bc4d5e0456bacc423743a30a7390
Loki
8f2fb0c54f7b6c6ccc3bc70cfa83165a4b8905b89744dd98a01ad7f632c82f95
Loki
a86f792a5a3d424b756508cb462d3ca9b454f2513a5471df5d41da33649748e9
Loki
bc568f10fe943dccb25ea6cd830cd4d54fbeef748e7da33bfac086f496c71bb2
Loki
d0a2be2c26efa68a6f69a4173b21c251b3c1e55b4d64cdf67394f923c9c23452
Loki
df07fc647c48c2ffeed6649fd82dd9ea0c51a0157f397b625bc4cc54f1609ee1
Loki
ec694537528f39e61c4a295e99932641ac2660f8580911790926294c4a190afc
Loki
ec744aeae689c95f44a24eb398e65c3a722595de5504db84b2e41488f30a7510
Loki
fe0a5fde4fbbddd79d2938af2373c69a8219ea73831be712f1bca86150a30461
Loki
+ 2'923 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot agilenet spyware stealer trojan
Link:
https://tria.ge/reports/210503-kf9fsneacs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Executes dropped EXE
Lokibot
Malware Config
C2 Extraction:
http://104.168.175.179/ghost2/panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
81c772e7c3443e928084c9c25b4b7a31002dbac9c4c977eeace73dd721243317
MD5 hash:
6c0c7128e3673edf9a8fb128a45a319e
SHA1 hash:
1f70c7daa4b2bee51f7a5e2a7315a8c54b606700
Link:
https://www.unpac.me/results/ada4f65a-4b44-49bd-b5e7-4d7f4192d6de/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/81c772e7c3443e928084c9c25b4b7a31002dbac9c4c977eeace73dd721243317

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Executable exe 81c772e7c3443e928084c9c25b4b7a31002dbac9c4c977eeace73dd721243317

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/148166/

Comments