MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83f31c20b1e1819627874ca9eeb2a8b703e28656a581289821415963dcf596b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 17

Intelligence 17 IOCs YARA 10 File information Comments

SHA256 hash:	83f31c20b1e1819627874ca9eeb2a8b703e28656a581289821415963dcf596b8
SHA3-384 hash:	85b81101f8bc27bfab68239e23cba3b29ef6b903d5ecd6dbd45006262e0ce37ad7d91778fecac34fa10ba6c69c3afd2f
SHA1 hash:	13a3343fcf472ac067ccb6e4c32cd47f1761e826
MD5 hash:	2750811b6c17c3c3ae345316f84aa921
humanhash:	asparagus-apart-orange-high
File name:	83f31c20b1e1819627874ca9eeb2a8b703e28656a581289821415963dcf596b8
Download:	download sample
Signature	Loki Create hunting rule
File size:	198'144 bytes
First seen:	2024-12-05 15:50:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	3072:4IzkRZo5uKwZ56Es5r0GgE1QR6XBGnglHQmaCvtdWfT:z61SLg9R6XplHQA
Threatray	1 similar samples on MalwareBazaar
TLSH	T1DA14BEA973E78E42C95C76B1C183410827728F4B7573E74A356C32691F723D7AE4AAC2
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
File icon (PE):
dhash icon	5105050000000045 (1 x Loki)
Reporter	adrian__luca
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

389

Origin country :

Vendor Threat Intelligence

Malware family:

lokibot

ID:

File name:

83f31c20b1e1819627874ca9eeb2a8b703e28656a581289821415963dcf596b8.exe

Verdict:

Malicious activity

Analysis date:

2024-12-05 15:58:07 UTC

Tags:

lokibot stealer trojan

Link:

https://app.any.run/tasks/e671b662-fb53-4471-9d18-ebd4481eb168

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.Siggen29.57230.19734.28892.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6751cc01bc8c6beb307600cc

Tags:

infosteal fareit spam

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a file

Сreating synchronization primitives

Reading critical registry keys

Changing a file

Connection attempt to an infection source

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for recently created files

Stealing user critical data

Query of malicious DNS domain

Unauthorized injection to a system process

Sending an HTTP POST request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fareit net_reactor obfuscated packed packed packer_detected stealer

Link:

https://www.filescan.io/uploads/6751cbf4f6c79c7aa8bce914/reports/68758b50-fe7d-4cbc-864c-ac6946cd0fbf/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/83f31c20b1e1819627874ca9eeb2a8b703e28656a581289821415963dcf596b8

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/14f23089-e528-4b7b-88af-0da3fe499109

Result

Threat name:

Lokibot, PureLog Stealer, zgRAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1569449

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected aPLib compressed binary

Yara detected Lokibot

Yara detected PureLog Stealer

Yara detected zgRAT

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/83f31c20b1e1819627874ca9eeb2a8b703e28656a581289821415963dcf596b8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/83f31c20b1e1819627874ca9eeb2a8b703e28656a581289821415963dcf596b8/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2024-10-22 08:41:30 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

27 of 38 (71.05%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qpzryifr4gazmj4hjsu65mviw4b6fbswuwasrgbbifmwhxhvs24a._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Loki

error

Loki

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection discovery spyware stealer trojan

Link:

https://tria.ge/reports/241205-taj92axlen/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Lokibot

Lokibot family

Malware Config

C2 Extraction:

https://dddotx.shop/Mine/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b5005cda-cae4-4e9d-a844-44557d634a41

Unpacked files

SH256 hash:

55edc01806a4ecd052464327f9c4d2c5eb82996111426aa5095a050afaa5f8f3

MD5 hash:

334b51f4ff0fc780b3118ffc78825e5f

SHA1 hash:

ffae94d70a3394f3fc9e8102f0805d12ad3024d7

Detections:

lokibot

win_lokipws_auto

win_lokipws_g0

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Lokibot

SUSP_XORed_URL_In_EXE

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_GENInfoStealer

STEALER_Lokibot

Link:

https://www.unpac.me/results/6d268c77-b456-4852-a54b-18b42780db4e/

Parent samples :

506acdbf6f6334fb4b7519e45d60f3c90b115853fa4b76d0670bf20698f4c7c4
bfcc16e302514e80fdc77675291f1bdb32796e7b77274f7596049938d0652347
088bb7500d35c7ab73827301e505660559437479ef46312c3ee08b6253f35953
7cfbe6d3f41c153c78f4e24211ffd891cde46411f072d83798e0e03e140a7021
83f31c20b1e1819627874ca9eeb2a8b703e28656a581289821415963dcf596b8

SH256 hash:

20a7b7fa27a8a3d79e7e124e1f0ce2ca2a647f432740565d2935badd84814027

MD5 hash:

bdbfc8de76d50d05a2dba4c515a50b90

SHA1 hash:

cac80a2c292d015d7c980724e9391b88d60f0f76

Detections:

INDICATOR_EXE_Packed_ConfuserEx

Link:

https://www.unpac.me/results/6d268c77-b456-4852-a54b-18b42780db4e/

Parent samples :

088bb7500d35c7ab73827301e505660559437479ef46312c3ee08b6253f35953
8b5e4c846dc98bdea2524651cf2895630c27bab15f5b27d60a9fd732b1c6ba3f
75173e92fd7a13e7be3ec177c5287280aae4d2a5e6911cd1458400d96289d18d
7cfbe6d3f41c153c78f4e24211ffd891cde46411f072d83798e0e03e140a7021
83f31c20b1e1819627874ca9eeb2a8b703e28656a581289821415963dcf596b8
d59042fb9666d5a2fcb62371be2ab5c51b708f27db5711659d6b6d54e261741e
ee8578ebf209462c50f37d8fceb524db53b5b97078aa0995c775133b8d3f9d64
62ad3f54c6adf2f358213da7c9729890d86d1f17444f23d159aa6455188b34bc
1d723e459d4edcfdba3c63825c9582341d356b22ecfc22b8a446b430e0b27be5
141a6b48b260182bfbf3419b85b4d63d06a9bc41dd8ac573528c74c980b01614
668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a
5aa774e9545c8b8ce704219aeb374be885ec8533eaa8562db4ad5118917582be
e8d4cd03450bee6fa32028e4e4e0e415d4c4bbfcb349e77170cd983226666820

SH256 hash:

83f31c20b1e1819627874ca9eeb2a8b703e28656a581289821415963dcf596b8

MD5 hash:

2750811b6c17c3c3ae345316f84aa921

SHA1 hash:

13a3343fcf472ac067ccb6e4c32cd47f1761e826

Link:

https://www.unpac.me/results/6d268c77-b456-4852-a54b-18b42780db4e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/83f31c20b1e1819627874ca9eeb2a8b703e28656a581289821415963dcf596b8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla Create hunting rule
Author:	Harish Kumar P
Description:	Yara Rule to Detect AgentTesla

Rule name:	DotNet_Reactor Create hunting rule
Author:	@bartblaze
Description:	Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	PureCrypter Create hunting rule
Author:	@bartblaze
Description:	Identifies PureCrypter, .NET loader and obfuscator.
Reference:	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample