MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 956741cfb963a29651abae4b0bee9185ad7688cdc0f97f2336c891daab84976e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 11

Intelligence 11 IOCs YARA 11 File information Comments

SHA256 hash:	956741cfb963a29651abae4b0bee9185ad7688cdc0f97f2336c891daab84976e
SHA3-384 hash:	9cabb1b2b73f53fa80921cf5068cb1f526de90d219015f71948633bf8715f17361d4f13d6fe41a056f24d5c9dfb2d69f
SHA1 hash:	6d3179490f9bb7ffa0f4947e0b3a91739ab4a1b3
MD5 hash:	6b83494affb3b33c0e40ca5a8ad5020c
humanhash:	montana-video-xray-india
File name:	Statement of account 2020.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	518'656 bytes
First seen:	2021-01-04 07:37:28 UTC
Last seen:	2021-01-04 09:30:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:ezQCEXpAywZMxkUzKBveCzyway2chm5RbuHnT:7CkVTzKEtvy9m5YT
Threatray	2'218 similar samples on MalwareBazaar
TLSH	7FB48C2523B86B2AE1BE73398530611097F5B857D724C27EBDE4E0CE9A71F4146B2732
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Malspam distributing Loki:

From: Mohamed Ishak <maxsus@crrt.uz>
Reply-To: Mohamed Ishak <lukamilli@autoshorp.com>
Subject: SOA 2020
Attachment: Statement of account 2020.zip (contains "Statement of account 2020.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

292

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Statement of account 2020.exe

Verdict:

Malicious activity

Analysis date:

2021-01-04 07:45:35 UTC

Tags:

trojan opendir lokibot stealer

Link:

https://app.any.run/tasks/a5a150df-8db5-4f9a-a022-5445bc21d658

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/110372/

Detection(s):

SecuriteInfo.com.Backdoor.MSIL.REMCOS.SM.22228.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Creating a file

Reading critical registry keys

Changing a file

Replacing files

DNS request

Creating a file in the %AppData% subdirectories

Stealing user critical data

Connection attempt to an infection source

Moving of the original file

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/573227

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM_3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/956741cfb963a29651abae4b0bee9185ad7688cdc0f97f2336c891daab84976e/

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=svtudt5zmorjmunlvzfqx3urqwwxncgnyd4x6izwzci5vk4es5xa._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/210104-586c1tvh4n/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Lokibot

Malware Config

C2 Extraction:

http://gulshanti.com/wp-templates/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

7434a3541ab1b6d26c8cc8fc004b3f4b6fc5c3e1a0688d3a306edc328fa7516b

MD5 hash:

8e03af479992c5b3adfac51796d69a8e

SHA1 hash:

1455fcbe1a7f6f5a2c0ea1135f45c0e12f196310

Link:

https://www.unpac.me/results/ee3c6fbd-6146-4f7c-8a53-9082f4f06f9d/

SH256 hash:

44106a7753790a12c522849b3f7da238337bd0342e5664021e25f79b2705ae9a

MD5 hash:

d43e8dcc8f8b23c144f820eaa9bdbee4

SHA1 hash:

41faa61eb543ac1386e59ef1e3c485a19458ff68

Link:

https://www.unpac.me/results/ee3c6fbd-6146-4f7c-8a53-9082f4f06f9d/

SH256 hash:

4f5f7e25c9e1d6070b274be110774b41ef7ca0bb4d1cbf35fb372833beead600

MD5 hash:

f1b7cb0574f2ed0af78e17a50b20bcc7

SHA1 hash:

44c0194e77ff3a72836b3853caab77c6bc334775

Link:

https://www.unpac.me/results/ee3c6fbd-6146-4f7c-8a53-9082f4f06f9d/

SH256 hash:

4f3a62171da8471aa6b39d84c80bd2e6a7f76b5f4941fa00ca9da35a99466662

MD5 hash:

bf42597885174d8a29e25538373d284f

SHA1 hash:

80255a84cf9dbf0d1a76b3765ec41183ad471630

Detections:

win_lokipws_g0

win_lokipws_auto

Link:

https://www.unpac.me/results/ee3c6fbd-6146-4f7c-8a53-9082f4f06f9d/

SH256 hash:

956741cfb963a29651abae4b0bee9185ad7688cdc0f97f2336c891daab84976e

MD5 hash:

6b83494affb3b33c0e40ca5a8ad5020c

SHA1 hash:

6d3179490f9bb7ffa0f4947e0b3a91739ab4a1b3

Link:

https://www.unpac.me/results/ee3c6fbd-6146-4f7c-8a53-9082f4f06f9d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Remcos

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/956741cfb963a29651abae4b0bee9185ad7688cdc0f97f2336c891daab84976e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com