MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9580201b4f6d893b50367e54383e90f0779302386b4a411d6df7bbfc1f1027e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9580201b4f6d893b50367e54383e90f0779302386b4a411d6df7bbfc1f1027e2
SHA3-384 hash: 0572df1da115ab281f0d4826d6b55c7341a7ecb67e1b180a2da6cbdb2687f8ee614d0ad27cf94bc7bf12f247c80d6b10
SHA1 hash: 10015d814f756a0da055331f56df3bb04e6d7c23
MD5 hash: 2a04daaf8a12cc600644bf4268e8c0a0
humanhash: sad-colorado-oklahoma-blossom
File name:2a04daaf8a12cc600644bf4268e8c0a0.exe
Download: download sample
Signature Loki
Create hunting rule
File size:1'532'928 bytes
First seen:2021-06-07 06:01:57 UTC
Last seen:2021-06-07 08:15:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:vk5TxkCGXAUVYtXiZmp7l8RPqL09LkI5rJ2m8GDBGmuAR:S6CGXAUYtXiZm1l8dqiLZ592m8GvuA
Threatray 18 similar samples on MalwareBazaar
TLSH 93658D1237A4B51BE23E56F03564050942FDBD4A9DEAEB7EBCC472EE09F2E0053117A6
Reporter abuse_ch
Tags:exe Loki

Intelligence

File Origin
# of uploads :
3
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2a04daaf8a12cc600644bf4268e8c0a0.exe
Verdict:
Suspicious activity
Analysis date:
2021-06-07 06:08:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b59ac490-980c-4986-b3ad-26254c0513b7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/164906/
Detection(s):
SecuriteInfo.com.Program.Win32.Wacapew.Cml.25396.7548.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/797799
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9580201b4f6d893b50367e54383e90f0779302386b4a411d6df7bbfc1f1027e2/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-06-07 04:53:14 UTC
AV detection:
2 of 46 (4.35%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=swacag2pnwetwubwpzkdqpuq6b3zgarynnfechln6657yhyqe7ra._file
Verdict:
unknown
Similar samples:
3133a128efbce5da52470d5898f3a89cbaeda1e2e78bb028edaf73594690e40a
Loki
378f88cc9bbe98557c78d51f384d2156a42f4a00d0c76f830e715c99650715b1
Loki
44b5209fadd63026c1f4c7f1d1a6b9f49aa76f8597579773a0bc0010bada5853
Loki
92249587f4034051ca019922a388b659536fad1cbbba9f2bdfd872867741041d
Loki
991a74bfa1338d3ff4e513f174dd7ee9abee5b83a799b754217af30df6857049
Loki
a2059d974b96a04e44f1197d988cc4d281c448ce5bf521cdf1476afb2bdd4b93
Loki
aa6a2d08bba4dc0149088f482643af47721a50013952548fe15415ff481a922e
Loki
b95c99701d429de9d8f52792d7a2b462ec6e342618a04ef419710b42e76293ff
Loki
c8f972ce679b3339b92813e06e995eb5d3795c5481bd9bf6e5d5fca97748caec
Loki
dda8fc961bfaa4ce908aa355f0994e5c30db6207c0f67e05afa2ae9b89df44b5
Loki
+ 8 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210607-sq7yd2887e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://173.208.204.37/k.php/mvM4bZPtu0I2s
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
34e69e90b7cb6121c3f93911f21dfb00491ea5d5bb79bfce4902d04f72c24184
MD5 hash:
b6b086a0ab13f3feb9ee8c846d230e5d
SHA1 hash:
dd8e1b816f3e7d9dcfa6eddc20a27fe0fbed478a
Link:
https://www.unpac.me/results/231bf756-52af-4598-9fc8-3bc1ee6b804e/
SH256 hash:
9580201b4f6d893b50367e54383e90f0779302386b4a411d6df7bbfc1f1027e2
MD5 hash:
2a04daaf8a12cc600644bf4268e8c0a0
SHA1 hash:
10015d814f756a0da055331f56df3bb04e6d7c23
Link:
https://www.unpac.me/results/231bf756-52af-4598-9fc8-3bc1ee6b804e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9580201b4f6d893b50367e54383e90f0779302386b4a411d6df7bbfc1f1027e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe 9580201b4f6d893b50367e54383e90f0779302386b4a411d6df7bbfc1f1027e2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1324851/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1323829/
Cape
Cape
https://www.capesandbox.com/analysis/164906/

Comments