MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82c6cac246c38f64f18bc576efa5f189ae25a94678141ee0ef57584bea126e79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82c6cac246c38f64f18bc576efa5f189ae25a94678141ee0ef57584bea126e79
SHA3-384 hash: 582cb4bd026193c72522e31c964bfcb0619b17d0f44db13ce6fa07a3d47607cc40465dc321ae3e80ec45b44351b79006
SHA1 hash: 88159ab453e6ef7756367456a6ddf28a582cef91
MD5 hash: 3a8ac9e546d50a49b602e12d74a9a4c1
humanhash: carpet-xray-winner-fillet
File name:Order 753.zip
Download: download sample
Signature Loki
Create hunting rule
File size:504'847 bytes
First seen:2021-07-03 05:41:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:ve/g0NaVChGB2VyBZgFSf/QU0vUjhVDV4IfsXrYMwmFEIVpuOYcJY/LVzBnaN5i:ve+TLBZgkf4U08jhtR0DFDVzFczE3i
TLSH 1AB423912D1623F89FC37E283E5A8756DC541BC788EEA1282616F1CD4C997B3C9C6623
Reporter cocaman
Tags:Loki zip


Avatar
cocaman
Malicious email (T1566.001)
From: "EXPORTS<sales@enlom.com.cn>" (likely spoofed)
Received: "from enlom.com.cn (unknown [103.155.80.90]) "
Date: "2 Jul 2021 06:49:18 -0700"
Subject: "Reply:_RE_:_RFQ_No._DAIDO-2021-QPE-Q63440093-0001_//ORDER FOR QUOTE_A-5555-1239_&_A-5004-0808"
Attachment: "Order 753.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2008.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.899-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23990.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/82c6cac246c38f64f18bc576efa5f189ae25a94678141ee0ef57584bea126e79
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82c6cac246c38f64f18bc576efa5f189ae25a94678141ee0ef57584bea126e79/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-03 05:42:10 UTC
File Type:
Binary (Archive)
Extracted files:
54
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qldmvqsgyohwj4mlyv3o7jprrgxclkkgpakb5yhpk5mex2qsnz4q._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210703-gw39jnchmn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://185.110.190.5/gugufdre.php/auJMYiGBL7JHG
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/82c6cac246c38f64f18bc576efa5f189ae25a94678141ee0ef57584bea126e79

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 82c6cac246c38f64f18bc576efa5f189ae25a94678141ee0ef57584bea126e79

(this sample)

Loki

Executable exe 8fac154accb9af445e125427d86d67be52b2d644baf26dfc777a195cd6905134

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8fac154accb9af445e125427d86d67be52b2d644baf26dfc777a195cd6905134
  
Dropping
Loki

Comments