MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 957ef05564cba68f526fe7d881b3957a933b14196205f2cf6d9e287c100ab85c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	957ef05564cba68f526fe7d881b3957a933b14196205f2cf6d9e287c100ab85c
SHA3-384 hash:	0bf98c30cb9b8b059f0fd2e8e9fd4caff6465b7a27b257f35275b0268c0f97f80a56522e5bf1f5d7be7114d2fd8e0a10
SHA1 hash:	1b40243a8e6a025eef866f09b7b4361b70777494
MD5 hash:	4047a1a03be9df604f06fdb28647891d
humanhash:	six-three-zulu-happy
File name:	SecuriteInfo.com.Trojan.DownLoader36.26314.8898.5357
Download:	download sample
Signature	Loki Create hunting rule
File size:	1'490'008 bytes
First seen:	2020-12-04 23:42:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	044c00ba0877e7ce0b5e1c462f6e7c9a (1 x Loki, 1 x ModiLoader)
ssdeep	24576:UAcx/7kfcBfKnvXYX6pVJhPUv/DH3q3Is+Oiw2MioqoqoqoygCQCQCQC6060606w:Uxv0dVXPUv/DUddxCp
Threatray	10 similar samples on MalwareBazaar
TLSH	1365B3FE7DAD40EADC3E283E6F55A0C8646E8EF4351440D1076B78ABC6737A6EC94901
Reporter	SecuriteInfoCom
Tags:	Loki

Intelligence

File Origin

# of uploads :

# of downloads :

306

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/106842/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader36.26314.8898.5357.UNOFFICIAL

PUA.Win.Trojan.Generic-6629274-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

DNS request

Sending an HTTP GET request

Unauthorized injection to a recently created process

Reading critical registry keys

Changing a file

Replacing files

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Stealing user critical data

Moving of the original file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/556170

Signature

Antivirus detection for URL or domain

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/957ef05564cba68f526fe7d881b3957a933b14196205f2cf6d9e287c100ab85c/

Threat name:

Win32.Trojan.ModiLoader

Status:

Malicious

First seen:

2020-12-04 19:57:32 UTC

AV detection:

27 of 29 (93.10%)

Threat level:

5/5

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/201204-qkpr8axeve/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Lokibot

Malware Config

C2 Extraction:

http://104.223.143.21/frilt/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php