MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2e10236dab3013a041ead462b2b280af3f4e9f96a3ca878579dce7d8fef23ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a2e10236dab3013a041ead462b2b280af3f4e9f96a3ca878579dce7d8fef23ec
SHA3-384 hash:	2a7aa45b6827dbc7c87f989f56e16e71e7c9433ee2a880866c4e119ef53a939be4a07e5b1553aba84ea3dad5a16479e5
SHA1 hash:	ea8bf14e6a59e72d0f2345f62b562f446f14f9be
MD5 hash:	012ba921b7d9f12671e476fbd91d1b9f
humanhash:	charlie-stairway-monkey-summer
File name:	PO_CW20188797-A & CW201.exe
Download:	download sample
Signature	Loki Alert Create hunting rule
File size:	508'928 bytes
First seen:	2023-12-18 17:36:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep	12288:Q2iNb0oLt0gSLJ6ElEfCb+lVbNrc8nj2J/BWPGdTdnDwPgg:Q16g5y+42Ndc8nj2LWPGdJDg
Threatray	4'254 similar samples on MalwareBazaar
TLSH	T184B4236037FC4BBDCD2E63F46E70046613B6158685A1FB984ED916EE28E1F52C3113AB
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	lowmal3
Tags:	exe Loki

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

406

Origin country :

DE

Vendor Threat Intelligence

ANY.RUN lokibot

Malware family:

lokibot

Alert

Create hunting rule

ID:

1

File name:

PO_CW20188797-A & CW201.exe

Verdict:

Malicious activity

Analysis date:

2023-12-18 17:37:55 UTC

Tags:

trojan lokibot

Link:

https://app.any.run/tasks/20282a14-7b2e-49c2-8094-de98d4b380af

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox LokiBot

Detection:

LokiBot

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/468328/

ClamAV Detected

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Changing a file

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for analyzed file

Searching for the window

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Сreating synchronization primitives

Reading critical registry keys

Stealing user critical data

Moving of the original file

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/65808341b4e856b7281eb48b/reports/d63182fd-5cc0-486e-98b2-8f6f5206094d/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/a2e10236dab3013a041ead462b2b280af3f4e9f96a3ca878579dce7d8fef23ec

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Loki

Malware family:

Loki

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1bd0f3c6-e39e-4466-8209-6157de1de656

Joe Sandbox Lokibot

Result

Threat name:

Lokibot

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1364075

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/a2e10236dab3013a041ead462b2b280af3f4e9f96a3ca878579dce7d8fef23ec

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a2e10236dab3013a041ead462b2b280af3f4e9f96a3ca878579dce7d8fef23ec/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.LokiBot

Threat name:

ByteCode-MSIL.Trojan.LokiBot

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-15 10:06:50 UTC

File Type:

PE (.Net Exe)

Extracted files:

7

AV detection:

18 of 37 (48.65%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ulqqenw2wmatuba6vvdcwkziblz7j2pzni6kq6cxtxhh3d7pepwa._file

Threatray lokipasswordstealer(pws)

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Alert

Create hunting rule

Similar samples:

941187cba9ad2e2c425279b5abd895e48c46c0be0ba7ff1a242535dee69a4b4b

Loki

a72c0d696fba8a092fe459d85ab642b49529b1b156e597da55dceb8cdf579cda

Loki

e2809bd060e2f3c578879f0131092baf39f09b30ee734903fd6e3840628653cf

Loki

ea5d5e6f93cfbb2ae2fa24346b05b65e93a6be558040d7d93750f29aa4a51de5

Loki

+ 4'244 additional samples on MalwareBazaar

Hatching Triage lokibot

Result

Malware family:

lokibot

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/231218-v65fhsdec4/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://178.128.238.137/index.php/25064245498223
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

UnpacMe lokibot win_lokipws_auto win_lokipws_g0 INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Lokibot SUSP_XORed_URL_In_EXE INDICATOR_SUSPICIOUS_Binary_References_Browsers INDICATOR_SUSPICIOUS_GENInfoStealer STEALER_Lokibot

Unpacked files

SH256 hash:

0ae7dfed203914b3ad21323c8fd0e1e5538b2f85055ee4aac69eb8480b9c517d

MD5 hash:

55ffbbeb4c035377aeea417fb47f5415

SHA1 hash:

e57ab9ef8bb707f66ba28244db5f04d19b4b7717

Link:

https://www.unpac.me/results/60d6f4bf-2518-4159-bee0-05d4f982e9d6/

SH256 hash:

d01f3dea3851602ba5a0586c60430d286adf6fcc7e17aab080601a66630606e5

MD5 hash:

579197d4f760148a9482d1ebde113259

SHA1 hash:

cf6924eb360c7e5a117323bebcb6ee02d2aec86d

Link:

https://www.unpac.me/results/60d6f4bf-2518-4159-bee0-05d4f982e9d6/

SH256 hash:

c5328f7af843244b56d6a208c322a9315daea139d1b255cda993b243e4394ecf

MD5 hash:

160f4669c06c6496d79a92ea9d33e89b

SHA1 hash:

baae226fdb2a9739f118db781bdc74f2efc6a585

Link:

https://www.unpac.me/results/60d6f4bf-2518-4159-bee0-05d4f982e9d6/

SH256 hash:

b03708c04e619602338862df427154899140a05c66ad15b6549619797524c52b

MD5 hash:

ba4b490bccbf0364d8760fe12412db10

SHA1 hash:

2383be0efe2a1a1ce348a594dac5d0101d79e511

Detections:

lokibot

Alert

Create hunting rule

win_lokipws_auto

Alert

Create hunting rule

win_lokipws_g0

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Alert

Create hunting rule

Lokibot

Alert

Create hunting rule

SUSP_XORed_URL_In_EXE

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_Binary_References_Browsers

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_GENInfoStealer

Alert

Create hunting rule

STEALER_Lokibot

Alert

Create hunting rule

Link:

https://www.unpac.me/results/60d6f4bf-2518-4159-bee0-05d4f982e9d6/

Parent samples :

d42c0f3feb463d2bc5899d453f2c5cc05efc8c4a63dff73982e0d0447f41a4b0
c08e53e8609b839287be32c0f5a60b84f6bf49b92ab4be44ca81f5c5dd836cd8
43194a603898e86d15bd6806fb7774ca6049263741ffba630cbfd4f8ae2fdcd1
ea5d5e6f93cfbb2ae2fa24346b05b65e93a6be558040d7d93750f29aa4a51de5
a2e10236dab3013a041ead462b2b280af3f4e9f96a3ca878579dce7d8fef23ec
e0f45f991af19ad7da6f4ddc80f9979dc5c3cf1b6e8166194727dcedba58a8a5

SH256 hash:

a2e10236dab3013a041ead462b2b280af3f4e9f96a3ca878579dce7d8fef23ec

MD5 hash:

012ba921b7d9f12671e476fbd91d1b9f

SHA1 hash:

ea8bf14e6a59e72d0f2345f62b562f446f14f9be

Link:

https://www.unpac.me/results/60d6f4bf-2518-4159-bee0-05d4f982e9d6/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Lokibot

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/a2e10236dab3013a041ead462b2b280af3f4e9f96a3ca878579dce7d8fef23ec

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

exe a2e10236dab3013a041ead462b2b280af3f4e9f96a3ca878579dce7d8fef23ec

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/468328/