MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9395cb22690c965a1f8f1154104c70abedf245d99f81b6cb9d90b4f0d245a5f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 10

Intelligence 10 IOCs YARA 8 File information Comments

SHA256 hash:	9395cb22690c965a1f8f1154104c70abedf245d99f81b6cb9d90b4f0d245a5f2
SHA3-384 hash:	cd2bebbe038a41dc42a46426a89a5ab3072ec313034bc628d8e88c4fe8cc04c458edc29d6663950be8709be2d1aaf2f4
SHA1 hash:	46ba9591abf77302c9f5a1e077187b4aca371011
MD5 hash:	1cb0218248ea6be6b4fc59e43bb88c99
humanhash:	fish-gee-timing-michigan
File name:	SecuriteInfo.com.Trojan.PWS.Stealer.29616.17848.19914
Download:	download sample
Signature	Loki Create hunting rule
File size:	471'040 bytes
First seen:	2020-11-27 14:40:45 UTC
Last seen:	2020-12-04 19:59:46 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'453 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:CY8V2g9SSlZ09FQFFFFFFFFFFFFFFFFFFFFFRYH8txxxxxxxxxxxxxxxxxxxxJy:p8V2g9S4ZIFqy
Threatray	2'054 similar samples on MalwareBazaar
TLSH	AEA49DDBE6450441DBE22431EA5ACB320B12AD3F6580489B11F67D273FDD263F427A9B
Reporter	SecuriteInfoCom
Tags:	Loki

Intelligence

File Origin

# of uploads :

# of downloads :

107

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/105825/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Using the Windows Management Instrumentation requests

Creating a file in the %AppData% subdirectories

Unauthorized injection to a recently created process

Creating a file

Reading critical registry keys

Changing a file

Replacing files

Deleting a recently created file

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Connection attempt to an infection source

Moving of the original file

Sending an HTTP POST request to an infection source

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/549436

Signature

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9395cb22690c965a1f8f1154104c70abedf245d99f81b6cb9d90b4f0d245a5f2/

Threat name:

ByteCode-MSIL.Infostealer.Maslog

Status:

Malicious

First seen:

2020-11-27 13:49:03 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=sok4witjbslfuh4pcfkbatdqvpw7erozt6a3ns45sc2pbusfuxza._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot persistence spyware stealer trojan

Link:

https://tria.ge/reports/201127-f9c361fgj2/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

Lokibot

Malware Config

C2 Extraction:

http://185.239.242.195/po1/1/cgi.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

51c180729d48a36d20e3482f2a66202ce0c67222444c0cb16247e7ed9af79cd4

MD5 hash:

7ad986debe678a4cd3486d5841d309db

SHA1 hash:

e6e0710e882a9fb99757ad20faddcd8840f55f00

Link:

https://www.unpac.me/results/bec7b3b0-642a-4a2e-af42-39e4a83bcdf9/

SH256 hash:

83c08f0721c8b0c96e3d6a8f3ccaf5c96fbcc427d574625c34424c3429fefaa1

MD5 hash:

3c5dbcc3bb27e913e14efd8054811373

SHA1 hash:

b0eba9388abddaef9d5aa49ccd5dbab2924cced0

Link:

https://www.unpac.me/results/bec7b3b0-642a-4a2e-af42-39e4a83bcdf9/

SH256 hash:

7494a9fce9b84fa9db058729befc085965e735a93557267052b5daa22ddfe065

MD5 hash:

f11ddfdc65c08f62029e26ff9b95bb7d

SHA1 hash:

8944ea4885cac582cf2d430bf1a82fcd8d54cac3

Detections:

win_lokipws_g0

win_lokipws_auto

Link:

https://www.unpac.me/results/bec7b3b0-642a-4a2e-af42-39e4a83bcdf9/

Parent samples :

9395cb22690c965a1f8f1154104c70abedf245d99f81b6cb9d90b4f0d245a5f2
dd4a332cc6dcf45491203ebf80cfac496574bacef8a5d5834d5f1d62b0346197
c144f554c5b73cc24df7980f7ca31114b413a8f3ac936360db4cc75a0b830f8d

SH256 hash:

9395cb22690c965a1f8f1154104c70abedf245d99f81b6cb9d90b4f0d245a5f2

MD5 hash:

1cb0218248ea6be6b4fc59e43bb88c99

SHA1 hash:

46ba9591abf77302c9f5a1e077187b4aca371011

Link:

https://www.unpac.me/results/bec7b3b0-642a-4a2e-af42-39e4a83bcdf9/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9395cb22690c965a1f8f1154104c70abedf245d99f81b6cb9d90b4f0d245a5f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com