MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99917a4af73a6bc84e8661662529e8cf69169486458a2d128deaebb6f3a29874. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99917a4af73a6bc84e8661662529e8cf69169486458a2d128deaebb6f3a29874
SHA3-384 hash: 83bb5c98e05f70b73734b86fbaee16e6be29a88f93655ee9db885000b3e28cb5db0acadebc587613636cddc8898d57fe
SHA1 hash: 3ea38cf084da7aa325ca96bf7a3b32a8250d8d45
MD5 hash: b1fc3fa2737fbca21fef7438ae85914f
humanhash: green-two-nitrogen-may
File name:Shipment Document BL,INV and Packing list.exe
Download: download sample
Signature Loki
Create hunting rule
File size:131'072 bytes
First seen:2021-09-13 12:41:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 44cde914d1969d7de2a52adae7c22460 (2 x GuLoader, 1 x Loki, 1 x Formbook)
ssdeep 1536:H3SfiqBR0M+0hY/DvpYTVK2BwKA7r+Yb4gYjPCi/g99i6ZwJDRSCImz:XSL03Z/zp8VK6w3R/cIv5ZwNRdImz
Threatray 5'250 similar samples on MalwareBazaar
TLSH T1A4D36CA07E4CA5B3C654D4F20221E56948D73C37DA905A0735A4BACB95323CF3CFAA5B
Reporter cocaman
Tags:DHL exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Shipment Document BL,INV and Packing list.exe
Verdict:
No threats detected
Analysis date:
2021-09-13 12:45:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/391ce982-23ee-4e68-aff2-3ace867160df

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/187458/
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61750167db358dd15ed91bb1/reports/e9ef3fc3-86d7-497f-ace1-87f72c506570/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0a5d08df-d948-4def-a1fd-78b2bdb8a195
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/849778
Signature
Executable has a suspicious name (potential lure to open the executable)
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Potential malicious icon found
Tries to detect Any.run
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/99917a4af73a6bc84e8661662529e8cf69169486458a2d128deaebb6f3a29874/
Threat name:
Win32.Trojan.Barys
Create hunting rule
Status:
Malicious
First seen:
2021-09-13 11:45:20 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
8 of 44 (18.18%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tgixusxxhjv4qtugmftckkpiz5urnfegiwfc2eun5lv3n45ctb2a._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
184676b18d687073308c791c9145f0b0c8bc6a75fd4ed7aff7803381701c06f0
Loki
2edfadf6a3fce7840cb3c3c5509f0f229c22b37b16b467139bc407f85d116eea
Loki
47046d5dfe7ecf45e4c31f25b975af78684f9727b91a7d052b5731e95d2f0a4c
Loki
4bb72d11d5f81e16f5113c8dc0c59d5331e0cf61259bea30dc57143ef30856b9
Loki
4ee78cf82b434634075e121ebbe7dce9aa4b0a18c04f54f70d84c891f7a56507
Loki
6a1be88d091d3365e9343a762f8ef32e88c6c0953efd09b7fdcc6bbf514b2ebd
Loki
6d0c8b1c8079ad4db2e523bdde3d9fed95003c5aa19073bceddb7b3375bfc6d2
Loki
821bc12d61a9ad2698823b6f54bbba6b8e9fba81a167a438f7da728d1dcd381d
Loki
ae83f208925ec791bd10f37e0cd1bfc98473ea586c4814288a243c7d579c2e55
Loki
db48dc160b1f48b8939b0d49c5f0bee2a28bc3b340cff62cea8da50424e1afea
Loki
+ 5'240 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:lokibot downloader spyware stealer trojan
Link:
https://tria.ge/reports/210913-pxdcsadfe7/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent file
Guloader,Cloudeye
Lokibot
Malware Config
C2 Extraction:
http://136.243.159.53/~element/page.php?id=474
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
49b04162c412105ab0857de16713724cbf3234a0b6ba51f3a5286312633f20c3
MD5 hash:
1f1b425190b2fb0396ad2d538b1060ba
SHA1 hash:
413f98641d46fdcabfcaf64f29495667de6282ea
Link:
https://www.unpac.me/results/955bfddd-9ce0-4945-b041-7677f956559a/
SH256 hash:
99917a4af73a6bc84e8661662529e8cf69169486458a2d128deaebb6f3a29874
MD5 hash:
b1fc3fa2737fbca21fef7438ae85914f
SHA1 hash:
3ea38cf084da7aa325ca96bf7a3b32a8250d8d45
Link:
https://www.unpac.me/results/955bfddd-9ce0-4945-b041-7677f956559a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/99917a4af73a6bc84e8661662529e8cf69169486458a2d128deaebb6f3a29874

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

ace f87d917c2f0bbfb88e5e9ab222b674dfdc1ca6078776f6f62308add91bc8f178

Loki

Executable exe 99917a4af73a6bc84e8661662529e8cf69169486458a2d128deaebb6f3a29874

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 f87d917c2f0bbfb88e5e9ab222b674dfdc1ca6078776f6f62308add91bc8f178
Cape
Cape
https://www.capesandbox.com/analysis/187458/

Comments