MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ff7c6e1141e67646bf9cc1887dd744b764985c26f3b5b70c5b257da1a83c523. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 14

Intelligence 14 IOCs YARA File information Comments 1

SHA256 hash:	9ff7c6e1141e67646bf9cc1887dd744b764985c26f3b5b70c5b257da1a83c523
SHA3-384 hash:	fdff9ac2210905c393c2f75b24085cf2ac92f0650e8411fb9adb2f5b8745391df382399f0f8cae0c653d7edc433bb59b
SHA1 hash:	9b53c78ee13ebbdfbed3134d5b3aa4777052452a
MD5 hash:	d604eeeca24981f94317b365ce258bd5
humanhash:	fish-cat-april-maryland
File name:	d604eeeca24981f94317b365ce258bd5
Download:	download sample
Signature	Loki Create hunting rule
File size:	132'583 bytes
First seen:	2022-06-09 08:33:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	dd1742eadfc6df18ded3c26ae64ad610 (31 x Formbook, 5 x RemcosRAT, 3 x AgentTesla)
ssdeep	3072:F14/IIhEDnmJ+f5qBKlUM6OK2zccN8d8dfp8e:FbGECMdK2zccN8dUf2e
Threatray	8'124 similar samples on MalwareBazaar
TLSH	T19BD3F187B7D0D8B3E5E206711A77F72AF7BB850820221F470B646FAA2925087D60D6D7
TrID	92.9% (.EXE) NSIS - Nullsoft Scriptable Install System (846567/2/133) 3.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 1.1% (.EXE) Win64 Executable (generic) (10523/12/4) 0.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 0.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	zbetcheckin
Tags:	32 exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

305

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

lokibot

ID:

File name:

EURO TT.xlsx

Verdict:

Malicious activity

Analysis date:

2022-06-09 06:29:54 UTC

Tags:

encrypted trojan exploit CVE-2017-11882 opendir loader lokibot stealer

Link:

https://app.any.run/tasks/fce1a7f9-731d-4a66-9d30-5bf795e18286

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/278148/

Detection(s):

SecuriteInfo.com.Trojan.NSISX.Spy.Gen.1.15020.23858.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Creating a process from a recently created file

Сreating synchronization primitives

Reading critical registry keys

Changing a file

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Enabling the 'hidden' option for recently created files

Unauthorized injection to a recently created process by context flags manipulation

Stealing user critical data

Query of malicious DNS domain

Sending an HTTP POST request to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/62a1b0c15dc88d35716e6512/reports/c17c5533-e077-4fd5-b3a8-4eb7dcccad68/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2a712a1c-cfe8-40d8-b860-81e627471e80

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1009812

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9ff7c6e1141e67646bf9cc1887dd744b764985c26f3b5b70c5b257da1a83c523/

Threat name:

Win32.Backdoor.Androm

Status:

Malicious

First seen:

2022-06-09 08:01:09 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 26 (80.77%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=t734nyiudztwi27zzqmipxlujn3etbocn45vw4gfwjl5ugudyurq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220609-kgetfshdc6/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Fake 404 Response

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

03650be5796d2eba26cccb5ab6d2547de851f7792f1ec89638e91eee324c29f3

MD5 hash:

794993e9941974ae8b699f84dfe85476

SHA1 hash:

f7e10ed9adff4235c9f44de3f6551bde2b9d6e8a

Link:

https://www.unpac.me/results/b02a88aa-6433-4474-802b-fc5426c9d4c0/

SH256 hash:

9ff7c6e1141e67646bf9cc1887dd744b764985c26f3b5b70c5b257da1a83c523

MD5 hash:

d604eeeca24981f94317b365ce258bd5

SHA1 hash:

9b53c78ee13ebbdfbed3134d5b3aa4777052452a

Link:

https://www.unpac.me/results/b02a88aa-6433-4474-802b-fc5426c9d4c0/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9ff7c6e1141e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.94

Link:

https://yomi.yoroi.company/submissions/9ff7c6e1141e67646bf9cc1887dd744b764985c26f3b5b70c5b257da1a83c523

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe 9ff7c6e1141e67646bf9cc1887dd744b764985c26f3b5b70c5b257da1a83c523

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2230905/

Cape

https://www.capesandbox.com/analysis/278148/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-06-09 08:33:53 UTC

url : hxxp://192.3.245.192/167/vbc.exe