MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f2fb0c54f7b6c6ccc3bc70cfa83165a4b8905b89744dd98a01ad7f632c82f95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	8f2fb0c54f7b6c6ccc3bc70cfa83165a4b8905b89744dd98a01ad7f632c82f95
SHA3-384 hash:	c18acd921b8d3590ca11c54fa0bf3ee737035dbc00e6ce24bdc4cb88571c4856e773bc4cf2ad945d6714c1154427e131
SHA1 hash:	b5c623c4a1d9d7f76254405ced674d64565e6379
MD5 hash:	2ac976b117da7c02d8f85e4efc17483d
humanhash:	triple-arkansas-utah-tennessee
File name:	Shipping _doc_pdf scan 0094775885895.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	1'324'544 bytes
First seen:	2021-03-09 15:48:31 UTC
Last seen:	2021-03-09 17:45:19 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	24576:4R2iivZQbqLA+2D1cpkmoDK2rIjPv8oQf3ns8Tu5V+IP9i+8gNAUVcmWqeUayGzK:4RivZQbqLA+2D1cpkmoDK2rIjPv8oQfC
Threatray	142 similar samples on MalwareBazaar
TLSH	91558C09BB84AFE5C1160F358927A81843F881675336FB5F3DD0A9E55E2074A4E2F4AF
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Malspam distributing unidentified malware:

HELO: pop.kenyaweb.com
Sending IP: 194.201.253.11
From: info@primecom.co.ke
Reply-To: shiping@penavicoyk.com
Subject: Arrival Notice (Shipping _doc_pdf scan 0094775885895)
Attachment: Shipping _doc_pdf scan 0094775885895.iso (contains "Shipping _doc_pdf scan 0094775885895.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

123

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Shipping _doc_pdf scan 0094775885895.exe

Verdict:

Malicious activity

Analysis date:

2021-03-09 16:56:36 UTC

Tags:

trojan lokibot stealer

Link:

https://app.any.run/tasks/850dc01a-0b3d-4ee2-9929-a8d8bc660536

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/123303/

Detection(s):

SecuriteInfo.com.Variant.Barys.24018.30901.26747.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Creating a window

Sending a UDP request

Creating a file in the %temp% directory

Creating a process from a recently created file

Creating a file

Reading critical registry keys

Changing a file

Replacing files

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Moving a file to the %AppData% subdirectory

Enabling the 'hidden' option for recently created files

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Stealing user critical data

Connection attempt to an infection source

Sending an HTTP POST request to an infection source

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/633133

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Woreflint

Status:

Malicious

First seen:

2021-03-09 09:47:09 UTC

AV detection:

15 of 28 (53.57%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r4x3brkppnwgztb3y4gpvaywljfysbnys5cn3gfadll7mmwif6kq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/210309-n9htc2mj4x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Loads dropped DLL

Executes dropped EXE

Lokibot

Malware Config

C2 Extraction:

http://becharnise.ir/fb13/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php