MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bdcb8eed0ddc7b700e3ac1ded641d2f5f703ea3cdfedc5eaad228f01cbb94d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 12

Intelligence 12 IOCs YARA File information Comments

SHA256 hash:	9bdcb8eed0ddc7b700e3ac1ded641d2f5f703ea3cdfedc5eaad228f01cbb94d6
SHA3-384 hash:	21c1d1085ce0e266c7f04ad0fcee88165214b7d244104085e632e88682ad13ee5b8436d4dc1104004bf816b6361c608e
SHA1 hash:	6031a2a5e8be0d2004f4422a6bf88ad11909c75b
MD5 hash:	fc9bb08703623f16b3b6fd654ab14b4a
humanhash:	juliet-utah-alaska-finch
File name:	fc9bb08703623f16b3b6fd654ab14b4a.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	425'568 bytes
First seen:	2021-08-17 07:51:49 UTC
Last seen:	2021-08-17 09:16:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	53c59b75f4f7c3e4cf3b5a4fc5238353 (3 x Formbook, 2 x Loki, 1 x RemcosRAT)
ssdeep	12288:WWAQN6SlDqx/YBUY7kpgr8GHlSoF+IsGq:WvrSlE/Yq9roF+PH
Threatray	4'274 similar samples on MalwareBazaar
TLSH	T1F694D012F180C131E47104B5D6F593BEB838AF70272B54E793D46A39AE716D27A34B2B
Reporter	abuse_ch
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

129

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Remittance Advice LHN1800152.xlsx

Verdict:

Malicious activity

Analysis date:

2021-08-17 06:56:49 UTC

Tags:

encrypted trojan opendir exploit CVE-2017-11882 loader lokibot stealer

Link:

https://app.any.run/tasks/d48982b2-b4d2-48dc-9505-a00c4f5d6200

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/179883/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen3.2198.7201.28728.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Reading critical registry keys

Changing a file

Replacing files

DNS request

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Sending a UDP request

Stealing user critical data

Moving of the original file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/dee10795-0b79-469f-9bd9-23b665e6cd59

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/834159

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9bdcb8eed0ddc7b700e3ac1ded641d2f5f703ea3cdfedc5eaad228f01cbb94d6/

Threat name:

Win32.Backdoor.NanoBot

Status:

Malicious

First seen:

2021-08-17 07:52:07 UTC

AV detection:

20 of 46 (43.48%)

Threat level:

5/5

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer suricata trojan

Link:

https://tria.ge/reports/210817-f1avfca7x2/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Lokibot

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://everydaywegrind.cf/Office4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php