MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 895a3f8a366ed73ca1cab8ef49582ada6382880654ab28e95b2902cde46e3726. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 14

Intelligence 14 IOCs YARA File information Comments

SHA256 hash:	895a3f8a366ed73ca1cab8ef49582ada6382880654ab28e95b2902cde46e3726
SHA3-384 hash:	fb5608294321284401d50b95c03399aef2edeaa159ba1e2a1315e522ec77e8303ad99666dde545d65d761006ab42284a
SHA1 hash:	f31b6ce7c4551844b48ecea8c2593c52fd0da89e
MD5 hash:	3ffe0bc9e3a2390ea85d60eb624f9369
humanhash:	stream-texas-fruit-chicken
File name:	3ffe0bc9e3a2390ea85d60eb624f9369.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	204'288 bytes
First seen:	2021-10-12 10:15:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	632b6dfbd7a49536efe298b2d0652a11 (3 x Smoke Loader, 2 x DanaBot, 2 x Loki)
ssdeep	6144:zAu3a8ssCUPeZCJVu/Ti7j86a5Vx98aCwiMzka7WyE:F3aR7oJUWP86GH8gPv
Threatray	12'431 similar samples on MalwareBazaar
TLSH	T11914D01132E0C871C7E716718874CBE65AFBB922563491CB2BD83A7E1E903D06E7A357
File icon (PE):
dhash icon	83bcdcac9cccb084 (1 x Loki)
Reporter	abuse_ch
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

169

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

3ffe0bc9e3a2390ea85d60eb624f9369.exe

Verdict:

Malicious activity

Analysis date:

2021-10-12 11:50:24 UTC

Tags:

trojan lokibot stealer

Link:

https://app.any.run/tasks/94e98725-4a5b-4f84-bd75-d49c4de25e29

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/196901/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Reading critical registry keys

Changing a file

Replacing files

Connection attempt to an infection source

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Stealing user critical data

Query of malicious DNS domain

Moving of the original file

Sending an HTTP POST request to an infection source

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a858eeaa-cc84-46db-a7c4-007ac729a347

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/868534

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/895a3f8a366ed73ca1cab8ef49582ada6382880654ab28e95b2902cde46e3726/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-10-12 08:53:56 UTC

AV detection:

20 of 28 (71.43%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rfnd7crwn3ltziokxdxuswbk3jryfcagksvsr2k3febm3zdog4ta._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Loki

282371a6cd19af1c0b076d80d1a34e0b5920427cfa998bc34f68c6d6d2601c08

Loki

326a1d117e9ef923d501834a27d9879e838906747cd53beb64d63ccd380a163d

Loki

51fcc5eebacd36d6c7d517b0fe8d73404bc475a114739be7d734f336212f7157

Loki

6c94aaedade1edd06fe15389c0ce3f005af3ebb0fee2b8977def98c79a77e4f9

Loki

78a4072c06fb761e449186c822a647cc74425180151f98f371af8e242cb515d0

Loki

c469e1d887ed4264016fba3205f29e98f39a1d7ea7441765aea39d1cf3f5d82f

Loki

d2487b8e8d953d349a76d407b4156ec5bf8873621305c855f001a55484a3bfb5

Loki

f228ebe1b6d660825c71c76528486d30fe68858362b0bab96a203b4eba670c35

Loki

+ 12'421 additional samples on MalwareBazaar

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/211012-mas4lscaer/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

outlook_office_path

outlook_win_path

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://checkvim.com/fd4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php