MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bdb2adacff9530fde8a0b020e84188b0b39995db62ba167608d8e2493bd3ee4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 10

Intelligence 10 IOCs 1 YARA File information Comments

SHA256 hash:	9bdb2adacff9530fde8a0b020e84188b0b39995db62ba167608d8e2493bd3ee4
SHA3-384 hash:	dd098d8319f74dc3e60c5f5dec2c1783df3879d33c672b049f2bdab42a2f92587e0863531d0554a3a40eaf9dab04297c
SHA1 hash:	407327255cd3db231a33de98d62baae2e5c31a99
MD5 hash:	af533ffcb3bdce014ddf8e991ddc0dce
humanhash:	ten-fillet-pasta-princess
File name:	REQUEST FOR A TENDER 12-08-2021 · pdf.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	155'648 bytes
First seen:	2021-08-12 07:30:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	59e6745bf35b42f470b21adfbf2b29c4 (5 x Loki)
ssdeep	3072:yxEJpxEqxE2wz/IqR3eQBtCkOlRrw9xEAxEKxEJ:IEJ7EAE2cNRuQBA6EmEgEJ
Threatray	7'692 similar samples on MalwareBazaar
TLSH	T157E38D3377C1844AE115CB7190F20A9C4F68FC5744491E0B2B21EF4FA9F9A36E4E769A
dhash icon	f8b8b8399993d0f0 (5 x Loki)
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Loki C2:
http://185.227.139.5/sxisodifntose.php/6We0YzNidcg3L

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://185.227.139.5/sxisodifntose.php/6We0YzNidcg3L	https://threatfox.abuse.ch/ioc/171861/

Intelligence

File Origin

# of uploads :

# of downloads :

130

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

REQUEST FOR A TENDER 12-08-2021 · pdf.exe

Verdict:

No threats detected

Analysis date:

2021-08-12 07:37:11 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/12902e8e-5dca-4328-8c35-4c1996cafedf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a process from a recently created file

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

GuLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/80ce0d6d-a324-4433-8514-4982dc339b67

Result

Threat name:

GuLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/831511

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

GuLoader behavior detected

Hides threads from debuggers

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9bdb2adacff9530fde8a0b020e84188b0b39995db62ba167608d8e2493bd3ee4/

Threat name:

Win32.Backdoor.Androm

Status:

Malicious

First seen:

2021-08-12 07:31:06 UTC

AV detection:

4 of 47 (8.51%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tpnsvwwp7fjq7xukbmba5bayrmfttgk5wyv2cz3arwhcje55h3sa._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:guloader family:lokibot downloader spyware stealer suricata trojan

Link:

https://tria.ge/reports/210812-vlm54wj4yj/

Behaviour

Modifies system certificate store

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Checks QEMU agent file

Guloader,Cloudeye

Lokibot

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://185.227.139.5/sxisodifntose.php/6We0YzNidcg3L
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

49b04162c412105ab0857de16713724cbf3234a0b6ba51f3a5286312633f20c3

MD5 hash:

1f1b425190b2fb0396ad2d538b1060ba

SHA1 hash:

413f98641d46fdcabfcaf64f29495667de6282ea

Link:

https://www.unpac.me/results/98322b20-55c1-4133-a190-378041f4d77f/

SH256 hash:

9bdb2adacff9530fde8a0b020e84188b0b39995db62ba167608d8e2493bd3ee4

MD5 hash:

af533ffcb3bdce014ddf8e991ddc0dce

SHA1 hash:

407327255cd3db231a33de98d62baae2e5c31a99

Link:

https://www.unpac.me/results/98322b20-55c1-4133-a190-378041f4d77f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/9bdb2adacff9530fde8a0b020e84188b0b39995db62ba167608d8e2493bd3ee4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample