MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 876f3337e8d083495ec8bc6ddbde10b7b5bb3f177e924e4fe581bea3e6fd5460. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 15

Intelligence 15 IOCs 1 YARA 13 File information Comments 1

SHA256 hash:	876f3337e8d083495ec8bc6ddbde10b7b5bb3f177e924e4fe581bea3e6fd5460
SHA3-384 hash:	1c21cc56c5a4d5d839e4553eb03d7a07f9248f82e638a58b1481f38b5b0ac237ed222bc8b619453a3d0b6d73e339358d
SHA1 hash:	94cf529b66f8979181757fc6f294f9b5bb4f36c2
MD5 hash:	3bd908cfb7024576919a44857e945e28
humanhash:	california-uncle-snake-green
File name:	3bd908cfb7024576919a44857e945e28
Download:	download sample
Signature	Loki Create hunting rule
File size:	591'872 bytes
First seen:	2022-06-09 09:14:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:SNk3Q2iN/I9qgx6WtZH0ekt3fWa5+Nesycc/4DSOhB2A0nc:Y1pIvx3ZXkt3fiNp1qcSbA6c
Threatray	9'677 similar samples on MalwareBazaar
TLSH	T151C4F0F59AF879A1E1281177B8A0603C3BE34E1DDC65D53ACA9BF60F35626C260F0917
TrID	72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.4% (.EXE) Win64 Executable (generic) (10523/12/4) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	zbetcheckin
Tags:	32 exe Loki

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://45.133.1.20/health12/five/fre.php	https://threatfox.abuse.ch/ioc/680000/

Intelligence

File Origin

# of uploads :

# of downloads :

320

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

lokibot

ID:

File name:

1654754886-10db2b0948a0ae80003-CFKi4i.7z

Verdict:

Malicious activity

Analysis date:

2022-06-09 08:35:13 UTC

Tags:

encrypted trojan opendir exploit CVE-2017-11882 loader lokibot stealer

Link:

https://app.any.run/tasks/c331cca8-e1d8-442e-b218-fd12020449c5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/278164/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Creating a file

Сreating synchronization primitives

Reading critical registry keys

Changing a file

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for analyzed file

Stealing user critical data

Moving of the original file

Sending an HTTP POST request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fareit packed

Link:

https://www.filescan.io/uploads/62a1ba31824d74ef94fa86e6/reports/3af53d06-d59b-413c-a076-e7175742ecf4/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c6f93e80-b7fa-47c8-8e15-afeaf37bf3fa

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1009835

Signature

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/876f3337e8d083495ec8bc6ddbde10b7b5bb3f177e924e4fe581bea3e6fd5460/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-06-09 09:15:11 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=q5xtgn7i2cbusxwixrw5xxqqw623wpyxp2je4t7fqg7khzx5krqa._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220609-k7w6eseddq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Fake 404 Response

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://45.133.1.20/health12/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://��З��Й��Й��я��

Unpacked files

SH256 hash:

53de5f2f2265b870109f14d608d5aeb303ffc426b4d8c9605e4d06ad7e042a87

MD5 hash:

127288b57e06a706afb9b350588c5280

SHA1 hash:

2b9ee3f85a7aa83ab3ecec93f4f05224cf93cf05

Detections:

win_lokipws_g0

win_lokipws_auto

lokibot

Link:

https://www.unpac.me/results/c0f52615-d7a2-4cd9-8d65-1d42b202bdfd/

Parent samples :

876f3337e8d083495ec8bc6ddbde10b7b5bb3f177e924e4fe581bea3e6fd5460
7a55eae7467ad00ca44249a6a5ae7c24d1e16f5206d074d9367337ab41a1acfd
58bcc4edf2e14afd8bf7040cd8e184806e9a930cc44f56dec6573dbfdcc578cf
b95fffa4b998dfd7fd76b71740219057610d517bddf6d9f1fdbdfc329c714e9b
22797d4f15b39d839cbb87cd4e0c302cef10d6ac7abab71f06cb87e98efa4463
823ce7eb2b8a050344a26ec96b158913b727dfe0b405c1c966f3356cf957f3d7
2a75670328de6d21a02995adbfc8f296c5a38cf6294eb828751e728d76cc6d63
357d3ec91867d7a5a1a0effeba56f9e4d07c7c8b98cdf84294eeabd9f80dd516
c5b5d33eac9d4387ece662c100b3bcc2fac47d060a66b5c7a080ba8ca345258c

SH256 hash:

829a7a2f4b3de5ead4dda0c48102f1a148d3d801f477508ef0424ab01f39a793

MD5 hash:

53fad05764edd64e8fd5e0e8359d72bd

SHA1 hash:

3cd4f5bf58eefa776828b5669734759685c93d80

Link:

https://www.unpac.me/results/c0f52615-d7a2-4cd9-8d65-1d42b202bdfd/

SH256 hash:

159205459b3c5f0bc6d6652be47aee5e355bae8b0b75f46f212cf6153a52f48a

MD5 hash:

2a68a232f2e2aebf5e844befde38ede7

SHA1 hash:

3d8b1e8faa893d5c4f07648274a282af942f8e70

Link:

https://www.unpac.me/results/c0f52615-d7a2-4cd9-8d65-1d42b202bdfd/

SH256 hash:

4f5645c914d7c71d713f3b97e5cb86223f88af13b6842c0ee3b9a2171bf26f29

MD5 hash:

00287531a1965897d6260fb6b7b397f4

SHA1 hash:

ae966e4a94296169f92fc1bd3a647d27afc8dc45

Link:

https://www.unpac.me/results/c0f52615-d7a2-4cd9-8d65-1d42b202bdfd/

SH256 hash:

876f3337e8d083495ec8bc6ddbde10b7b5bb3f177e924e4fe581bea3e6fd5460

MD5 hash:

3bd908cfb7024576919a44857e945e28

SHA1 hash:

94cf529b66f8979181757fc6f294f9b5bb4f36c2

Link:

https://www.unpac.me/results/c0f52615-d7a2-4cd9-8d65-1d42b202bdfd/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/876f3337e8d0/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/876f3337e8d083495ec8bc6ddbde10b7b5bb3f177e924e4fe581bea3e6fd5460

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	LokiBot Create hunting rule
Author:	kevoreilly
Description:	LokiBot Payload

Rule name:	malware_Lokibot_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	MAL_Lokibot_Stealer Create hunting rule
Description:	Detects Lokibot Stealer Variants

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe 876f3337e8d083495ec8bc6ddbde10b7b5bb3f177e924e4fe581bea3e6fd5460

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/278164/

URLhaus

https://urlhaus.abuse.ch/url/2230952/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-06-09 09:14:30 UTC

url : hxxp://198.12.89.203/700/vbc.exe