MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97d4b97ab4f5880766783a88742969d0995cc86463e05a920486f390139667bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 14

Intelligence 14 IOCs YARA 4 File information Comments

SHA256 hash:	97d4b97ab4f5880766783a88742969d0995cc86463e05a920486f390139667bc
SHA3-384 hash:	15ec202867a4865f0e4ce49af6f3ddf1fe7e39930b88f6e4efe2569e674d35ea5286f7081e551c3b2bca4baff21c6c43
SHA1 hash:	0e9e7b3bdb690d391b941520b9acb3fe20008368
MD5 hash:	3eb855cf3d2aad29074cca7aabc54180
humanhash:	foxtrot-fix-carpet-salami
File name:	Angebotsanfrage 05·10·2021·pdf.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	409'088 bytes
First seen:	2021-10-05 10:35:06 UTC
Last seen:	2021-10-05 10:35:48 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	6144:7P40bCry6Tnh3Q+3HwOcc0WM2Y7zXNcOUqdWL7CDgrClaG9PYVoPWiN:Tugocc0WMp7rNcNqdWL7CD+ClaG9Pwu
Threatray	4'855 similar samples on MalwareBazaar
TLSH	T18D94AE9533AF6F45ED348FF4181CA0C157BA6C376169D3690ED1B0FE6922BB00A91E63
File icon (PE):
dhash icon	eac6a6cc96b28acc (16 x Loki)
Reporter	targodev
Tags:	.NET exe Loki

targodev

Recieved via E-Mail, impersonating the current President of the Humboldt-University in Berlin, Germany (including the sender mail). It is written in syntactically perfect german but with a few grammar quirks. Also the content of the message seems strange / somewhat implausible. The mail praises the recipients company with a request to fill out the attached invoice and to offer the best price to the Humbolt-University. Pressure is kept up by asking the recipient to answer within 3 days (recieved 05.10.2021, asked to answer by 08.10.2021).

==== Mail Headers ====
Return-Path: <REDACTED_SENDER_A>
Received-SPF: None (mailfrom) identity=mailfrom; client-ip=62.201.172.24; helo=shout01.mail.de; envelope-from=REDACTED_SENDER_A; receiver=<UNKNOWN>
Authentication-Results: 'REDACTED_A'; dmarc=none (p=none dis=none) header.from=hu-berlin.de
Authentication-Results: REDACTED_A;
dkim=pass (2048-bit key; unprotected) header.d=mail.de header.i=@mail.de header.b="7Mb4dms4";
dkim-atps=neutral
Received: from shout01.mail.de (shout01.mail.de [62.201.172.24])
by REDACTED_A (Postfix) with ESMTPS id 6E1B2981833
for <REDACTED_B>; Tue, 5 Oct 2021 10:53:29 +0200 (CEST)
Received: from postfix01.mail.de (postfix03.bt.mail.de [10.0.121.127])
by shout01.mail.de (Postfix) with ESMTP id 428E01004AA
for <REDACTED_B>; Tue, 5 Oct 2021 10:53:22 +0200 (CEST)
Received: from dovecot05 (dovecot05.bt.mail.de [10.0.121.115])
by postfix01.mail.de (Postfix) with ESMTP id C8937801C2
for <REDACTED_B>; Tue, 5 Oct 2021 10:53:21 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mail.de;
s=mailde202009; t=1633424001;
bh=ylVrySoj3b+cm744Tk18V7DBIo253h+EDGAFO+u7tVw=;
h=Date:From:To:Subject:Reply-To:From;
b=7Mb4dms44toBNi+ihrViecLlPn520VWqBs896Ew1t7hLAJ+10gAU7MBIEDVEtFCYV
i5JVATE6UzALjBxTvlXwf3nsDBpVnX3qZhw4lMzRGzxJ1rFsqri+ODvoibKC4+WzdL
XXwJRaISkEqFNgi4hDONnQZwRpKFrBR2BpNsFQEMCLGOZTAQnGnKNeqzZgcFxy+GIy
r5Wl/mgGeN4t+72qErfJ7GzCYVRNHQG7C5A44aWOeE7cIUdWmT/GneSCB0hs+5f6LA
awQEzwkBCoiToqhBJaxYzTiW/zPcdCZE87tSiz0qHTHtEnDFbQbl5fSZbtePju6QRp
1X7uqHMX6SsEQ==
X-Sieve: Pigeonhole Sieve 0.4.24.2 (aaba65b7)
X-Sieve-Redirected-From: REDACTED_C
Delivered-To: REDACTED_C
Received: from director03 ([10.0.121.146])
by dovecot05 with LMTP id sBjDCoESXGG8agAAAP82Bw
for <REDACTED_C>; Tue, 05 Oct 2021 10:53:21 +0200
Received: from localhost ([10.0.121.146])
by director03 with LMTP id oOiFCoESXGFcIAAAUyPkog
; Tue, 05 Oct 2021 10:53:21 +0200
X-Original-To: REDACTED_C
Authentication-Results: mxpostfix02.mail.de; spf=none (mailfrom) smtp.mailfrom=hu-berlin.de (client-ip=217.65.97.131; helo=west.ikron.hu; envelope-from=REDACTED_SENDER_A; receiver=<UNKNOWN>)
Authentication-Results: mxpostfix02.mail.de; dmarc=none (p=none dis=none) header.from=hu-berlin.de
Authentication-Results: mxpostfix02.mail.de; dkim=none; dkim-atps=neutral
Received: from west.ikron.hu (expurgate03.bt.mail.de [217.65.97.131])
by mxpostfix02.mail.de (Postfix) with ESMTP id C74338015B
for <REDACTED_C>; Tue, 5 Oct 2021 10:53:20 +0200 (CEST)
Received: from [217.65.97.131] (helo=west.ikron.hu)
by mx03.mail.de with ESMTPS (eXpurgate 4.32.0)
(envelope-from <REDACTED_SENDER_A>)
id 615c1278-6d2c-0a0078cb0019-d9416183e400-3
for <REDACTED_C>; Tue, 05 Oct 2021 10:53:13 +0200
X-Envelope-To: REDACTED_D
[REMOVED_SEVERAL_MORE_X-ENVELOPE_HEADERS]
MIME-Version: 1.0
Date: Tue, 05 Oct 2021 11:52:45 +0300
From: =?UTF-8?Q?Humboldt-Universit=C3=A4t_zu_Berlin?=
<REDACTED_SENDER_A>
To: undisclosed-recipients:;
Subject: =?UTF-8?Q?Angebotsanfrage_=28Humboldt-Universit=C3=A4t_zu_Berlin?=
=?UTF-8?Q?=29_05/10/2021?=
Reply-To: REDACTED_SENDER_A, REDACTED_SENDER_B,
REDACTED_SENDER_C@abv.bg
Message-ID: <10ee08472bcccddd93151369b0147e06@hu-berlin.de>
X-Sender: REDACTED_SENDER_A
Content-Type: multipart/mixed;
boundary="=_35ea40a6443731f915292262d658481c"
X-Virus-Scanned: clamav-milter 0.102.4 at west
X-Virus-Status: Clean
X-purgate-ID: 153031::1633423993-00006D2C-C506565F/7/0
X-purgate-type: dangerous.attachment
X-purgate-size: 444094
X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de
X-purgate: dangerous
===================

I've redacted personal information because I don't want to dox anyone. REDACTED_SENDER_A and REDACTED_SENDER_B relate to the president of Humboldt-University. REDACTED_SENDER_C is a russian-sounding name. I left in any information about Humboldt-University and its president, which are publically available.

==== Mail Content ====
Humboldt-Universität zu Berlin

Unter den Linden 6, 10117 Berlin, Germany

+49 30 2093-REDACTED

Guten Morgen aus der Humboldt-Universität zu Berlin

Wir haben gute Bemerkungen über Ihr Unternehmen erhalten. Prof. Dr.-Ing.
Dr. Sabine Kunst, Präsidentin der Humboldt-Universität zu Berlin, laden
Sie ein, Ihren kommerziellen Vorschlag für unser Schulbudget 2021
einzureichen (Anlage).
Geben Sie uns so schnell wie möglich die besten Preise. Stellen Sie
sicher, dass Ihr Angebot vor dem 08. Oktober 2021 eintrifft. Wenn wir
Ihr Angebot erhalten haben, besuchen wir Ihr Unternehmen für weitere
Gespräche. Finden Sie den Anhang, lassen Sie es uns sofort wissen, wenn
Sie weitere Informationen benötigen.

Danke und viele Grüße.

Prof. Dr.-Ing. Dr. Sabine Kunst

Präsidentin der Humboldt-Universität zu Berlin

Unter den Linden 6, 10117 Berlin, Germany

Email: REDACTED_SENDER_A

Telefon: +49 30 2093-REDACTED

_______________________________________________________________
Haftungsausschluss! Bitte drucken Sie diese E-Mail nur aus, wenn es
unbedingt erforderlich ist!
Diese Nachricht (einschließlich aller Anhänge) ist Eigentum der
humboldt-universität zu berlin und enthält vertrauliche Informationen,
die für eine Person und einen bestimmten Zweck bestimmt sind und
gesetzlich geschützt sind. Wenn Sie nicht der beabsichtigte Empfänger
sind, müssen Sie diese Nachricht löschen und Sie darüber informieren,
dass jegliche Offenlegung, Vervielfältigung oder Verbreitung dieser
Nachricht sowie jegliche diesbezügliche Handlung strengstens untersagt
ist.

Virenfrei www.avast.com
==================

Intelligence

File Origin

# of uploads :

# of downloads :

190

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Angebotsanfrage 05·10·2021·pdf.exe

Verdict:

Malicious activity

Analysis date:

2021-10-05 09:26:24 UTC

Tags:

trojan lokibot stealer

Link:

https://app.any.run/tasks/8df33171-ee91-4d81-99d8-30d94c98633b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/194983/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.935-1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Creating a file in the %temp% directory

Delayed writing of the file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/615c2baa98a6280f39324e5f/reports/e6af247f-97a9-4eb2-9d78-8dfe132284fa/overview

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9b520ebc-eb5e-4827-a385-8abb3f8ffcb5

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/864686

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/97d4b97ab4f5880766783a88742969d0995cc86463e05a920486f390139667bc/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-10-05 10:36:05 UTC

AV detection:

21 of 45 (46.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=s7kls6vu6weaoztyhkehiklj2cmvzsdempqfveqeq3zzae4wm66a._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot evasion spyware stealer suricata trojan

Link:

https://tria.ge/reports/211005-mm9bcshhfl/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Maps connected drives based on registry

Checks BIOS information in registry

Reads user/profile data of web browsers

Looks for VMWare Tools registry key

Looks for VirtualBox Guest Additions in registry

Lokibot

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://136.243.159.53/~element/page.php?id=172
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

bbd1b0f58c646f3f22015c83ca558f31cab0533eb43e83bdd5d2ca0e1fb5ca00

MD5 hash:

3b34c76ad2904835ce2b980a8494afaf

SHA1 hash:

8530c106a8ae56ae98335a7b4fe9dff9d0a3236b

Detections:

win_lokipws_g0

win_lokipws_auto

Link:

https://www.unpac.me/results/1bd22f4a-ce61-438b-ab8a-b166c8e4a761/

Parent samples :

f766172a832b46a611cd2eb873012ea08c48cdfd5b4901259c440f5f87d95a9f
11306262bd1f1063b69b91dc2bce27093c38de0548d23fcb464414ad0a6c5400
96bf6fa59f5e9f7ab817fd0c2ed49b9e6d4d011cc7884f4961865edd3d80570c
97d4b97ab4f5880766783a88742969d0995cc86463e05a920486f390139667bc
8eea9f59761a743b9084236ac54983e803838f2cb46d6424310334e260201def
0f7b1d33d44c2df099ebcac2627f07269bdadc33182d867a8de06dd0e8991536
1b34d2afa6705ff6291bb774b44c4ef03f60321d63e34efdd8a07f512187c136

SH256 hash:

b6d944179e16b161d996c79ff93d01d42ccaa0129b3953e0347423297ca5d4d1

MD5 hash:

f4b6bf93ce221c3b5754cbf9a02c5776

SHA1 hash:

547cc2f048baced46a110c6d55ad4d14d86b0181

Link:

https://www.unpac.me/results/1bd22f4a-ce61-438b-ab8a-b166c8e4a761/

SH256 hash:

fe8637d821a39a8b74abce7e043007d38cb9c5cfcb7098af9846cfd98185ac03

MD5 hash:

c380b6831f456ac5cac08c78c0e4dada

SHA1 hash:

3e241a0b9d96c1dfbadd7ee1a8c5ee6d74eba11c

Link:

https://www.unpac.me/results/1bd22f4a-ce61-438b-ab8a-b166c8e4a761/

SH256 hash:

97d4b97ab4f5880766783a88742969d0995cc86463e05a920486f390139667bc

MD5 hash:

3eb855cf3d2aad29074cca7aabc54180

SHA1 hash:

0e9e7b3bdb690d391b941520b9acb3fe20008368

Link:

https://www.unpac.me/results/1bd22f4a-ce61-438b-ab8a-b166c8e4a761/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/97d4b97ab4f5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/97d4b97ab4f5880766783a88742969d0995cc86463e05a920486f390139667bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip 745f4c8779d5d06a11961abfe988f02954f4d4484bd45b625a07773fc19dabe6

Loki

exe 97d4b97ab4f5880766783a88742969d0995cc86463e05a920486f390139667bc

(this sample)

Malpedia

https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws

Dropped by

SHA256 745f4c8779d5d06a11961abfe988f02954f4d4484bd45b625a07773fc19dabe6

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/194983/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample