🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a31d2ee1eacc5cec9a03080380a46a1fa22c663e828bc1726c2022f4fa62ce3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a31d2ee1eacc5cec9a03080380a46a1fa22c663e828bc1726c2022f4fa62ce3
SHA3-384 hash: 04dccdbb6bae721432313af2e51bcd140393e376aee862cff9f3e7bab04e72ec3d32a3e4889eec7b3152de412818de89
SHA1 hash: fb81d9612c2b77d1f0d55e00ebf41e89b09afff8
MD5 hash: 9d99f0ec29e2c29e08cf16d68e47d35e
humanhash: cup-aspen-black-violet
File name:PI_COAU65239841.docx
Download: download sample
Signature Loki
Create hunting rule
File size:10'328 bytes
First seen:2021-11-08 12:19:47 UTC
Last seen:Never
File type:Word file doc
MIME type:application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep 192:ScIMmtP+RyLG/bWo+pYOcamWBXjtc3zqDrN:SPXWR9B+pYOcoTtME
TLSH T153226D3CD206F81BC11205BDD19583F1EB286153F7227D1D7090B2ED0BA05D7979EAAE
Reporter proxylife
Tags:cve-2017-0199 doc Loki Lokibot

Intelligence

File Origin
# of uploads :
1
# of downloads :
356
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
File type:
application/msword
Has a screenshot:
False
Contains macros:
False
Detection(s):
SecuriteInfo.com.W97M.Downloader.Gen-2.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.RemoteFrameDominion.20210721.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
OOXML Word File
Link:
https://app.docguard.net/9a31d2ee1eacc5cec9a03080380a46a1fa22c663e828bc1726c2022f4fa62ce3/results/dashboard
Payload URLs
URL
File name
https://roslet.com/y8
webSettings.xml.rels
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
CVE-2017-0199 exploit
Link:
https://www.filescan.io/uploads/618915f50f74fb2806734536/reports/e7104428-819d-4747-a778-e704f4ce8bb1/overview
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/885230
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains an external reference to another file
Drops PE files to the user root directory
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Office equation editor drops PE file
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Droppers Exploiting CVE-2017-11882
Sigma detected: Execution from Suspicious Folder
Sigma detected: File Dropped By EQNEDT32EXE
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 517699 Sample: PI_COAU65239841.docx Startdate: 08/11/2021 Architecture: WINDOWS Score: 100 33 secure01-redirect.net 2->33 35 roslet.com 2->35 45 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 15 other signatures 2->51 8 EQNEDT32.EXE 12 2->8         started        12 WINWORD.EXE 306 50 2->12         started        signatures3 process4 dnsIp5 27 C:\Users\user\AppData\Local\...\vbc[1].exe, PE32 8->27 dropped 29 C:\Users\Public\vbc.exe, PE32 8->29 dropped 61 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 8->61 15 vbc.exe 1 5 8->15         started        39 roslet.com 172.67.188.125, 443, 49165, 49169 CLOUDFLARENETUS United States 12->39 41 104.21.43.235, 443, 49166, 49167 CLOUDFLARENETUS United States 12->41 43 107.172.73.207, 49171, 49173, 80 AS-COLOCROSSINGUS United States 12->43 31 ~WRF{863BFBA1-A2C8...B-14BCC88939BC}.tmp, Composite 12->31 dropped file6 signatures7 process8 signatures9 63 Tries to steal Mail credentials (via file registry) 15->63 65 Injects a PE file into a foreign processes 15->65 18 vbc.exe 54 15->18         started        23 vbc.exe 15->23         started        process10 dnsIp11 37 secure01-redirect.net 85.143.175.133, 49176, 49177, 49178 TRADERSOFTRU Russian Federation 18->37 25 C:\Users\user\AppData\...\5879F5.exe (copy), PE32 18->25 dropped 53 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->53 55 Tries to steal Mail credentials (via file / registry access) 18->55 57 Tries to harvest and steal ftp login credentials 18->57 59 Tries to harvest and steal browser information (history, passwords, etc) 18->59 file12 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a31d2ee1eacc5cec9a03080380a46a1fa22c663e828bc1726c2022f4fa62ce3/
Threat name:
Document-Office.Exploit.CVE-2017-0199
Create hunting rule
Status:
Malicious
First seen:
2021-11-08 12:20:06 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan websettings
Link:
https://tria.ge/reports/211108-phrxmacad8/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Launches Equation Editor
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Office loads VBA resources, possible macro or embedded object present
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Abuses OpenXML format to download file from external location
Loads dropped DLL
Reads user/profile data of web browsers
Uses the VBS compiler for execution
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Lokibot
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/9a31d2ee1eac/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.99
Link:
https://yomi.yoroi.company/submissions/9a31d2ee1eacc5cec9a03080380a46a1fa22c663e828bc1726c2022f4fa62ce3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments