MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0e358657312ddd1b269aae62b64c60ceb4df2a5a58335362379ee96afea23cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a0e358657312ddd1b269aae62b64c60ceb4df2a5a58335362379ee96afea23cd
SHA3-384 hash:	77eca4ab04abf1e338ab5537401e13a07f8132cf57439c81cb6fc4550a30451d6d946a4d4456fe2c1c74e6e8a3915480
SHA1 hash:	8832088953af0f6ab74854f44a6f64c656e6069f
MD5 hash:	9fbb2531343e3f6225b6ba4cdf2d157f
humanhash:	beer-batman-steak-michigan
File name:	9fbb2531343e3f6225b6ba4cdf2d157f.exe
Download:	download sample
Signature	Loki Alert Create hunting rule
File size:	635'392 bytes
First seen:	2023-05-13 06:52:33 UTC
Last seen:	2023-05-13 22:46:09 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	12288:dpmYz3ZaA7mB/KmztqdMSBGDSa/TfMBXjywB:rmYzp1mcmztmMwGOa/Tf6X+
Threatray	4'080 similar samples on MalwareBazaar
TLSH	T1F9D4D085433BBDD1DA5417B1220438534E2EB11A74F8F4FCBD1BB889C9AE9115BE8A73
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	abuse_ch
Tags:	exe Loki

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

250

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN lokibot

Malware family:

lokibot

Alert

Create hunting rule

ID:

1

File name:

9fbb2531343e3f6225b6ba4cdf2d157f.exe

Verdict:

Malicious activity

Analysis date:

2023-05-13 06:57:53 UTC

Tags:

trojan lokibot

Link:

https://app.any.run/tasks/4766dc5d-6f24-4b4a-acaa-7cc15f7ff866

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/388871/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.66987803.15034.20692.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Enabling the 'hidden' option for analyzed file

Moving of the original file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

comodo packed

Link:

https://www.filescan.io/uploads/645f33d1446f9ce94a659731/reports/cd46d9b7-cd5f-4d43-b26c-c21bc055fc2f/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/a0e358657312ddd1b269aae62b64c60ceb4df2a5a58335362379ee96afea23cd

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Loki

Malware family:

Loki

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8e21c7b7-fccf-4279-b003-b5d49b4cfd07

Joe Sandbox Lokibot

Result

Threat name:

Lokibot

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1232063

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a0e358657312ddd1b269aae62b64c60ceb4df2a5a58335362379ee96afea23cd/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.SnakeKeylogger

Threat name:

ByteCode-MSIL.Trojan.SnakeKeylogger

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-11 03:39:21 UTC

File Type:

PE (.Net Exe)

Extracted files:

7

AV detection:

20 of 24 (83.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=udrvqzltclo5dmtjvltcwzggbtvu34vfuwbtknrdphxjnl7kepgq._file

Threatray lokipasswordstealer(pws)

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Alert

Create hunting rule

Similar samples:

04f557582bc8b4c4af843d0c837124da73f887ac5b997efdd78f96d45caced85

Loki

0f6a0c8f4c9d3fa419bd22b2687328e7a721ad0b1ef504a64166b1c630997cee

Loki

26cfdd614196dd8f128f01480c55504960ecafad60991455a030cc5c73130f2a

Loki

4e12ca0674f72503e00f35b8b27aa98da0855baa9e25264b357bb934e31a2217

Loki

594a574211cffc47d78817221315092ab978403b71e1ff43922286ec9f60e188

Loki

7f0fcb4f3651ec6a3b273322857afe8aa8373f77964afd0bb592378a4a97fe1a

Loki

a1f8dd874a1d63dfbd2cc504fbe6d5784eb00610b02fef44b606b7a127f41bc4

Loki

a3a76a33a4641ac3a8b6ebbc137ecf08c69be86d7a1d810754be57dd1f5baac9

Loki

f3797cb6054ef9d5de1b4ecb2745424ef0481c5cb28ec2f2384d2591019e1650

Loki

+ 4'070 additional samples on MalwareBazaar

Hatching Triage lokibot

Result

Malware family:

lokibot

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/230513-hnnc3aff99/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://208.67.105.148/morgan/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

UnpacMe lokibot win_lokipws_auto win_lokipws_g0

Unpacked files

SH256 hash:

ea1a5df9760d29610bea19018826a526e9f20fef5869a71755ebbc472d92f996

MD5 hash:

ca3952dc192a4d1f32eb879570cfae1b

SHA1 hash:

cae7b0394e0eb7781d365c88ba9cc010465cf3e3

Detections:

lokibot

Alert

Create hunting rule

win_lokipws_auto

Alert

Create hunting rule

win_lokipws_g0

Alert

Create hunting rule

Link:

https://www.unpac.me/results/65639e44-e920-4f35-bec0-8dd7e0199d72/

Parent samples :

0cd6273cb957d6e97a533d50c86de4980c956f55119bb511f17a5c0458f10f21
50ee6f613fdfbbe0ab3745d1641f98df80be37ab88bb587cde4baf3835e5637c
3ae26e4ae40658d87e41bc65a3a04a386d66e7802629c016b3453f536c632642
ac8856b90f8dc00344bab702e9ab5f5dfad41082ea44f3a42ec7a0a86a51d2da
31f19001d973bfaa236dffd2fb024efcbb775c76d3bd078c106be6d02df1f7d9
1e0557bb24ff7057aa35904c7ce0edf8cd20c7dee89bbcd9485cce5b04fb80ce
a0e358657312ddd1b269aae62b64c60ceb4df2a5a58335362379ee96afea23cd

SH256 hash:

a62b0a9d7853a5b7892575afda26a9537e32e18a782aa33a9653280ddd7b8dfb

MD5 hash:

0ae77609c90df4e9dab84c67d0b0eeaf

SHA1 hash:

b3454518978768b0568c1420e6e9609fdaf777cc

Link:

https://www.unpac.me/results/65639e44-e920-4f35-bec0-8dd7e0199d72/

SH256 hash:

c72ca892abebd8794a9544913d071c3c91356f5075509717727e180e87cb98ba

MD5 hash:

25383385b11436b817ed4dc0419f4e24

SHA1 hash:

9441f35f45a30503ebb2c717209f29341b5b48b6

Link:

https://www.unpac.me/results/65639e44-e920-4f35-bec0-8dd7e0199d72/

SH256 hash:

6e252eee98a086e49a25424618df2838a2ef08d5e5d359281f96161cd4abc0bf

MD5 hash:

0220c0b8cb5b8c7c04b5f014a646f316

SHA1 hash:

673ee490b8badb52802dae78b31f55298048b361

Link:

https://www.unpac.me/results/65639e44-e920-4f35-bec0-8dd7e0199d72/

SH256 hash:

d8fc5dfdf2800247eb610beb076fec4d2becf6d951e89445d43237fe97814218

MD5 hash:

e5d93dadd08b8bc727e4f4853c6881ba

SHA1 hash:

27e0e057d33f01586193b0cbf06561c2863951f4

Link:

https://www.unpac.me/results/65639e44-e920-4f35-bec0-8dd7e0199d72/

SH256 hash:

a0e358657312ddd1b269aae62b64c60ceb4df2a5a58335362379ee96afea23cd

MD5 hash:

9fbb2531343e3f6225b6ba4cdf2d157f

SHA1 hash:

8832088953af0f6ab74854f44a6f64c656e6069f

Link:

https://www.unpac.me/results/65639e44-e920-4f35-bec0-8dd7e0199d72/

VMRay Lokibot

Malware family:

Lokibot

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a0e358657312/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe a0e358657312ddd1b269aae62b64c60ceb4df2a5a58335362379ee96afea23cd

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2627530/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/388871/