MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84e98f3890f5726bce09f463487b93b93de8edff0ba96fb07e06631422ab71d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84e98f3890f5726bce09f463487b93b93de8edff0ba96fb07e06631422ab71d0
SHA3-384 hash: fe1ba64988054224c9a03fa46bd334d99c89d9d06e341331918121aaf42a7a76a4e5416b6efe14fb49f727cbb58d2d15
SHA1 hash: bbf73f7c8e9ad081a1477af15962665264667cf0
MD5 hash: da243a80ff9f58530e015efdd38490af
humanhash: oranges-floor-robert-coffee
File name:da243a80ff9f58530e015efdd38490af.exe
Download: download sample
Signature Loki
Create hunting rule
File size:206'395 bytes
First seen:2021-04-09 20:22:53 UTC
Last seen:2021-04-09 20:49:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 18bc6fa81e19f21156316b1ae696ed6b (51 x Formbook, 24 x Loki, 9 x SnakeKeylogger)
ssdeep 6144:HdZrFTT6Jzn6EyNZyS8F0WfW/boxx3F8ii+s:3xf6JwOS98W/boxx18L+s
Threatray 4'654 similar samples on MalwareBazaar
TLSH 4414125221D1BDB7FE114670027A973BEB73C0E1212144171BB92FABFD30A52992E6E7
Reporter abuse_ch
Tags:exe Loki

Intelligence

File Origin
# of uploads :
2
# of downloads :
277
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SwiftMT103.xlsx
Verdict:
Malicious activity
Analysis date:
2021-04-09 09:04:38 UTC
Tags:
encrypted opendir exploit CVE-2017-11882 loader trojan formbook stealer
Link:
https://app.any.run/tasks/52706bcc-5a24-4523-b961-3bac217c6ed3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/133456/
Detection(s):
SecuriteInfo.com.Variant.Jaik.45029.11199.10741.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/671802
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to prevent local Windows debugging
Detected unpacking (changes PE section rights)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 384846 Sample: jEXf5uQ3DE.exe Startdate: 09/04/2021 Architecture: WINDOWS Score: 100 31 www.theccmsacademy.com 2->31 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 6 other signatures 2->45 11 jEXf5uQ3DE.exe 18 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\...\kgjurndwr.dll, PE32 11->29 dropped 55 Detected unpacking (changes PE section rights) 11->55 57 Maps a DLL or memory area into another process 11->57 59 Tries to detect virtualization through RDTSC time measurements 11->59 61 Contains functionality to prevent local Windows debugging 11->61 15 jEXf5uQ3DE.exe 11->15         started        signatures6 process7 signatures8 63 Modifies the context of a thread in another process (thread injection) 15->63 65 Maps a DLL or memory area into another process 15->65 67 Sample uses process hollowing technique 15->67 69 Queues an APC in another process (thread injection) 15->69 18 explorer.exe 15->18 injected process9 dnsIp10 33 redfiendpub.com 160.153.136.3, 49753, 80 GODADDY-AMSDE United States 18->33 35 www.chateaudedigoine.com 156.235.173.61, 49734, 80 DXTL-HKDXTLTseungKwanOServiceHK Seychelles 18->35 37 18 other IPs or domains 18->37 47 System process connects to network (likely due to code injection or exploit) 18->47 22 help.exe 18->22         started        signatures11 process12 signatures13 49 Modifies the context of a thread in another process (thread injection) 22->49 51 Maps a DLL or memory area into another process 22->51 53 Tries to detect virtualization through RDTSC time measurements 22->53 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/84e98f3890f5726bce09f463487b93b93de8edff0ba96fb07e06631422ab71d0/
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2021-04-09 02:40:14 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qtuy6oeq6vzgxtqj6rruq64txe66r3p7bouw7md6azrriivlohia._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
28f57adc56668022a2db544f26ea18b9015ca4ab414dd825eafc3e8c4b179c63
Loki
4061fb72cf023e7dbc619c0d3ee7c66e1acbb3810aba3fae2592f400d4ee1006
Loki
55f20748f621bf247877b71a3682640e5ec013d51c52363b5c51cca50b44c1bf
Loki
6bb8fa14bf9c650a67541ffedff2e3f1c055454b90489653c95aa39284d7eb92
Loki
a086821049463b0bfc414cb3763c4f82688182d2d018ae5c9cd472f59f9e36ff
Loki
c494dceddfa1c8c6944a93f902c641ab5f99352ba48b81849e576f7da353314c
Loki
cd292d4cdb5ff8f2de087a09de2a152722d910f1df7ce7b65e6480be9ae77fdf
Loki
e4938a8244543631ae11deb46e8b4cc3f0a8b8b7c2d4a1246f5bfadb29e0094c
Loki
f45a023c86d834183f3073c05227d6f40686aef4a71b3893b823be493d7aae83
Loki
f7e96b7c6612b709e413bbc8c72796cadbb7ce91ed17ec77d5ba4d4422e729cb
Loki
+ 4'644 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader loader rat
Link:
https://tria.ge/reports/210409-emlgc3f46x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Xloader Payload
Xloader
Malware Config
C2 Extraction:
http://www.zlzntiayc.icu/a6ru/
Unpacked files
SH256 hash:
dfae0cacdafbe5b433782f9ea80b2fd6b5ee862eca61a4c0d41bda72ff05aeaa
MD5 hash:
a04b42204c506495a4842dbe6fe21357
SHA1 hash:
1f4d545c1ced6bc96d8b3953434ee62f6f13e9ea
Link:
https://www.unpac.me/results/2a9090a7-2413-47e0-86b9-375b660d49ee/
SH256 hash:
84e98f3890f5726bce09f463487b93b93de8edff0ba96fb07e06631422ab71d0
MD5 hash:
da243a80ff9f58530e015efdd38490af
SHA1 hash:
bbf73f7c8e9ad081a1477af15962665264667cf0
Link:
https://www.unpac.me/results/2a9090a7-2413-47e0-86b9-375b660d49ee/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/84e98f3890f5726bce09f463487b93b93de8edff0ba96fb07e06631422ab71d0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe 84e98f3890f5726bce09f463487b93b93de8edff0ba96fb07e06631422ab71d0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1104232/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/133456/

Comments