MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cc6bdf7b52d9f28c5ec9a489b230a56c0fc38daad835210d89debce56bf617b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cc6bdf7b52d9f28c5ec9a489b230a56c0fc38daad835210d89debce56bf617b
SHA3-384 hash: 0748e3d090c9a688c6684c787d61fb472cc768e229977efd02e3f4528d666cb9b72a6d2bdec5f5d7edbdaec38f977aea
SHA1 hash: 62438169f40c4d4b626dae796eb1f84294e6d961
MD5 hash: 2e90cb72eb0d8c0b716c61b7b8a0da37
humanhash: enemy-carbon-potato-moon
File name:SecuriteInfo.com.W32.AIDetectNet.01.8636.31435
Download: download sample
Signature Loki
Create hunting rule
File size:532'480 bytes
First seen:2022-07-20 10:50:08 UTC
Last seen:2022-07-25 12:03:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:jDW831ha+6GEUqSb2aA5NQ3R8LDzOJbe:WQa+6hUqSbbeAMUbe
Threatray 8'465 similar samples on MalwareBazaar
TLSH T10AB4E00032BC5FA2D9BD83F95865A48513F6171F712EE3994ED2B0DF2A7AF510A40E4B
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b271c0cccccc61b2 (16 x AgentTesla, 8 x Loki, 8 x SnakeKeylogger)
Reporter SecuriteInfoCom
Tags:exe Loki

Intelligence

File Origin
# of uploads :
2
# of downloads :
304
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/292897/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.8636.31435.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Reading critical registry keys
Enabling the 'hidden' option for analyzed file
Stealing user critical data
Moving of the original file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62d7de300e298a94f3e2c77e/reports/9e8cf3bb-2185-4bf3-ae97-d61e019837ba/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1037405
Behaviour
Behavior Graph:
n/a
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9cc6bdf7b52d9f28c5ec9a489b230a56c0fc38daad835210d89debce56bf617b/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-07-20 10:51:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
28
AV detection:
19 of 26 (73.08%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ttdl355vfwpsrrpmtjejwiykk3apyog2vwbveegytxv44vv7mf5q._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
2cd74481605fe52c417ebef95b792bf4c9c84f258b0bf0d2e3d416feeaa9316c
Loki
3c000108374c842e22e4bf480441d013e260c170c6d87defb15c322a4d136adb
Loki
3de2b99f225f06ff2d1a1f29fd6d9a02cc2820d0d929ca3f85e22e9743085865
Loki
74f8c18d247ab45ceb774418eb3604377501c92c6db387d070ba0511d9e82f04
Loki
795e024722b66cec49e060a39d2c0b9ce4b66981dc027f19f8a91f64db569387
Loki
9a2cb78785196ff5a09b428bcf2325d0d3f2455d3607e86edac32273b9a66705
Loki
bc38b033642b64f5aabea83069639bed9dd1197c0ecab8bcdd225010adc45fe3
Loki
daf1d21f570270cea93b1f7238636e31aa2a5f328917e30b125f677c723bd46e
Loki
edc745edbc90dfb8a30e14e9049998bc3c707eadb7ac3ef8785f0c80efe306c4
Loki
f9f068d3c13e5a04ea12013ee0b7c6984d7ea23b74d5147e144b939d52524b22
Loki
+ 8'455 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/220720-mxtnnafabp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://198.187.30.47/p.php?id=12495881296063980
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
4486fe4b891799f44f0b8389b89cdf96c0cc6dce593d78a254757d558d4bea04
MD5 hash:
9a8177a66bbc7df01166e14cbeeb1bc5
SHA1 hash:
f9341dbdecca7ab5e967d9d5b3a7dae409fd5369
Link:
https://www.unpac.me/results/ff206cec-49ff-444f-8a4e-eabae3c77315/
SH256 hash:
39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807
MD5 hash:
db51fe170a9e5d6ec5429a2fbd9d0353
SHA1 hash:
e30a58125fc41322db6cf2ccb6a6d414ed379016
Link:
https://www.unpac.me/results/ff206cec-49ff-444f-8a4e-eabae3c77315/
SH256 hash:
5d29301ec6116f1237010f70b3d6e60597dbb5ddf1c13ea70061ef342228a4fe
MD5 hash:
d5d55e1ba32f97e147e570d0948fbf67
SHA1 hash:
5ddeb0a629c10b071f02b2ff8c3b394e8817ff41
Link:
https://www.unpac.me/results/ff206cec-49ff-444f-8a4e-eabae3c77315/
SH256 hash:
e738dd86f652727b7293689f7237f3335e1fc1eb1239781d1e74cd3c24e51fe1
MD5 hash:
46c7ef5c6620eb84b1367374af787225
SHA1 hash:
594e24f332e28c43fa3504f99dcea93758e95256
Link:
https://www.unpac.me/results/ff206cec-49ff-444f-8a4e-eabae3c77315/
SH256 hash:
cb51ff5abffdccb12a5e70f9494c873202e182e377affd1985ad15422f49e926
MD5 hash:
cb26d628ca8bcf5ed9ed307535c4a18a
SHA1 hash:
4db5941fc4673a9b581bcc3630c128de70675aba
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
lokibot
Create hunting rule
Link:
https://www.unpac.me/results/ff206cec-49ff-444f-8a4e-eabae3c77315/
Parent samples :
1a07532785f1d0a43b0b5d68d54e411dd3f1bf1faec90deba15e2bff2df86cff
681027c5c8739002781c2ffe25273746712a78a3f2cfcec3b29f86360afef36b
ad1309082f2ee88adbcb7de7f92e905ca4b2db0e5eb2744cc0d8b420910d2678
e1b861fc650b19ff0790662c1988e2875f7286f7f206c312cf3c3f525ab33055
9cc6bdf7b52d9f28c5ec9a489b230a56c0fc38daad835210d89debce56bf617b
SH256 hash:
9cc6bdf7b52d9f28c5ec9a489b230a56c0fc38daad835210d89debce56bf617b
MD5 hash:
2e90cb72eb0d8c0b716c61b7b8a0da37
SHA1 hash:
62438169f40c4d4b626dae796eb1f84294e6d961
Link:
https://www.unpac.me/results/ff206cec-49ff-444f-8a4e-eabae3c77315/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9cc6bdf7b52d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/9cc6bdf7b52d9f28c5ec9a489b230a56c0fc38daad835210d89debce56bf617b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/292897/

Comments