MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a30f2d7a748897b9cd07e6d500f64c5dc27860b40eca83e0bccda43acc3aac0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a30f2d7a748897b9cd07e6d500f64c5dc27860b40eca83e0bccda43acc3aac0e
SHA3-384 hash: 06bf98fbd4d09447beff433a78fc75d78ac4fad3c43d90a49e510f01ab6d7ab82b380cbb9e8bdffad9af00a171e7de16
SHA1 hash: feb9fa7b6b078019dae8e07448f6444c1d032ea0
MD5 hash: 676fd7a98b15bc3e81e772e08dec5a4f
humanhash: cold-california-sixteen-robin
File name:Swift Copy MT103.rar
Download: download sample
Signature Loki
Create hunting rule
File size:594'976 bytes
First seen:2022-07-28 08:42:56 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:VMtad8e8pNBf02814LoyO+NFrdfZcop0dptQtSGi4gElSSJJdu/GcN/q9rC:VsE8rz0JSu74tKYvJJcGcNig
TLSH T1E8C4233F2B49AE5CD6C311259E8949B92F29A307A77F570C5B275CC08FC1ACD89E0653
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:Loki rar SWIFT

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a30f2d7a748897b9cd07e6d500f64c5dc27860b40eca83e0bccda43acc3aac0e/
Threat name:
ByteCode-MSIL.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-07-28 02:27:59 UTC
File Type:
Binary (Archive)
Extracted files:
32
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=umhs26turcl3ttih43kqb5smlxbhqyfub3fihyf4zwsdvtb2vqha._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/220728-kmklwsada2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://66.29.145.162/?10316882234268616
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar a30f2d7a748897b9cd07e6d500f64c5dc27860b40eca83e0bccda43acc3aac0e

(this sample)

Loki

Executable exe 3675872eadb638b3a00a1c2790013f71d8236d35f1ee79839fa2fa2f48972a86

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3675872eadb638b3a00a1c2790013f71d8236d35f1ee79839fa2fa2f48972a86
  
Dropping
Loki

Comments