MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fde220d40458eceb049d049f5391e8b2ff8f60e49d64d1272602e97d000a742. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 15


Intelligence 15 IOCs 1 YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8fde220d40458eceb049d049f5391e8b2ff8f60e49d64d1272602e97d000a742
SHA3-384 hash: df8ef5bf0af79a98e724b12a5d715dfa4d8cda8f0fd7e02d1b6208f352f794a7729ae82720004eadddd392770f3351ad
SHA1 hash: 73e04864d4c4d7d402c082c4a6cd9934dd9907cc
MD5 hash: fe66ecbd6fd8ab53daf22a4f759ba8fe
humanhash: eight-echo-violet-north
File name:EFS Quote PO81021.exe
Download: download sample
Signature Loki
Create hunting rule
File size:236'326 bytes
First seen:2021-08-10 08:21:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f6b61b8e7cfb6c1ac49476384f4084e5 (8 x Loki, 4 x Formbook, 1 x SnakeKeylogger)
ssdeep 3072:7KhRNLktPfWpUDQKsZo9vYCyQw4pa1AfLYPnEpDIEBtK9h1Wi8prbLdhnzcy2bx:76Nk2pFF+pgup4AfLYPPawfW1pbnz8x
Threatray 4'066 similar samples on MalwareBazaar
TLSH T16F340201FE442DB7C63E68FCA3A8927CA2C9540463905EF362D587756E70AFCA7B6850
dhash icon c89c98acacacbcac (31 x Loki, 23 x AgentTesla, 22 x AveMariaRAT)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://185.227.139.5/sxisodifntose.php/eOUCAsuJW0chL

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.227.139.5/sxisodifntose.php/eOUCAsuJW0chL https://threatfox.abuse.ch/ioc/167100/

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
EFS Quote PO81021.exe
Verdict:
Malicious activity
Analysis date:
2021-08-10 08:24:31 UTC
Tags:
trojan lokibot stealer
Link:
https://app.any.run/tasks/f1fccdf8-d512-430e-b190-bd3b824b0720

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/177849/
Detection(s):
Win.Dropper.Smdd-6956905-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Reading critical registry keys
Changing a file
Replacing files
Connection attempt
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Sending a UDP request
Stealing user critical data
Moving of the original file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fab80e96-9227-42ca-85c4-3a7876d4a409
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/829997
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8fde220d40458eceb049d049f5391e8b2ff8f60e49d64d1272602e97d000a742/
Threat name:
Win32.Trojan.Hynamer
Create hunting rule
Status:
Malicious
First seen:
2021-08-10 02:25:44 UTC
AV detection:
14 of 47 (29.79%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r7pcedkaiwhm5mcj2be7koi6rmx7r5qojhle2etsmaxjpuaau5ba._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
16a140ef10b0ea8bf9d2b139d26c447d9e8d090801dc82cc77d4f06a6a80c8fc
Loki
2d65a3c7da04463e34efa56f9754da234575e1082c239ce1aad1d2115d4d029a
Loki
750733fd4c90de2a0003bd6bbc410f61bfc88f1a2b70e6d8846a937b8372807a
Loki
7e0c5eb5f18d5313c39c806aeb2ee42b3ca22661c6c1aa2eb0fbead3948f6e26
Loki
989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe
Loki
bbbe39716fc34ce2fc73e72a86669a1948ed5fb6a83ab0ce7f939409ac5d5474
Loki
c59840f2a37cc434ef9e343de8cb199142f80d6dd77e7cfa0869972c76f2af34
Loki
e9e3490df4628c80e10723892c75cd036d340e4a09ca9527c5710e1b01e3847a
Loki
+ 4'056 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer suricata trojan
Link:
https://tria.ge/reports/210810-b8czrb6xf6/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://185.227.139.5/sxisodifntose.php/eOUCAsuJW0chL
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
cf31f499d5887498551b5b2f9b51a35de533a410b04ee6e5d4b513ec23bcdecd
MD5 hash:
90c00ad641111d77d20a51bd1f5d6a75
SHA1 hash:
4d5cf6dda909e411ae772e4a8ffe9c6f1385e874
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/646e85cd-8c62-45e5-976a-de47b8a94ea3/
SH256 hash:
8fde220d40458eceb049d049f5391e8b2ff8f60e49d64d1272602e97d000a742
MD5 hash:
fe66ecbd6fd8ab53daf22a4f759ba8fe
SHA1 hash:
73e04864d4c4d7d402c082c4a6cd9934dd9907cc
Link:
https://www.unpac.me/results/646e85cd-8c62-45e5-976a-de47b8a94ea3/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8fde220d4045/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/8fde220d40458eceb049d049f5391e8b2ff8f60e49d64d1272602e97d000a742

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/177849/

Comments