MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a01feeb43fac99c6270a8f3b0f3db9de1de8ccaf8edb8e207ed547842fd3cf8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a01feeb43fac99c6270a8f3b0f3db9de1de8ccaf8edb8e207ed547842fd3cf8d
SHA3-384 hash: bf1c67730b9d8e04499b0e2329f66b206c947a115382bda448ad09d7dce05fb4e925e241880d365c1c52540bc86b6786
SHA1 hash: e2957656134f6fc70a02beac4c28c4865377c9e7
MD5 hash: 38aed88adfeff1ade7eb881e7974a003
humanhash: cold-social-july-summer
File name:POE6709000.JS.js
Download: download sample
Signature Loki
Create hunting rule
File size:2'135 bytes
First seen:2021-07-28 07:35:56 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 48:D2shQ7ArgjjC/xbXQfDu/XS7+3jJZ/pP8+etCDBjPympQyUyuF1H:Csh+AwC/xzQfDu/XSq3dZ/xLnQjH
TLSH T1A841CC4C5C18A5B037C20FA35E35A199D7C54CE571CAAC8AE048F590380E8DD99EEA39
Reporter abuse_ch
Tags:js Loki


Avatar
abuse_ch
Loki C2:
http://ikloki.xyz/vf/cf/ro.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://ikloki.xyz/vf/cf/ro.php https://threatfox.abuse.ch/ioc/163327/

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Exploit.HTML-Downloader.Gen.25575.22177.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Gathering data
Threat name:
Document-HTML.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2021-07-28 07:36:05 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uap65nb7vsm4mjykr45q6pnz3yo6rtfpr3ny4id62vdyil6tz6gq._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot evasion spyware stealer suricata trojan
Link:
https://tria.ge/reports/210728-em8a1df3mj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Looks for VMWare Tools registry key
CustAttr .NET packer
Looks for VirtualBox Guest Additions in registry
Lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Malware Config
C2 Extraction:
http://ikloki.xyz/vf/cf/ro.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/a01feeb43fac99c6270a8f3b0f3db9de1de8ccaf8edb8e207ed547842fd3cf8d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments