MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3c57266f4f2f229c35a60c0c07914b8029d22f4e258288b296b3e2669e1d566. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3c57266f4f2f229c35a60c0c07914b8029d22f4e258288b296b3e2669e1d566
SHA3-384 hash: 8a66c454f6616a924a1226e40d7b9d6f4fa9d256aafdec88a793494b2f0d7eeeedccac9bc596758db6fdbe4f3923552d
SHA1 hash: 41a9fc240746155357201ebe0a60e765e8f84137
MD5 hash: 61cfd4abd701e3d5e2d482f170a839ed
humanhash: pip-connecticut-friend-idaho
File name:Contract No 64889955.exe
Download: download sample
Signature Loki
Create hunting rule
File size:834'048 bytes
First seen:2022-02-14 15:11:01 UTC
Last seen:2022-02-21 09:06:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:ZfOm2XtXVfRBuBiAkMe401l/XE2zDiyZTDOqxL2PF9Jg+vqx/IUBWpakNX:ZfJ2zjMvV0Fzm4vWdMr/In/
Threatray 6'893 similar samples on MalwareBazaar
TLSH T15205F10077AA9B23C5BB0F7BD4E641406770EA5A5567D37F68D036EC8C8B3581E7223A
File icon (PE):PE icon
dhash icon f8a4b2b4b4b4b2c0 (20 x AgentTesla, 8 x Loki, 6 x Formbook)
Reporter adrian__luca
Tags:exe Loki

Intelligence

File Origin
# of uploads :
2
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/241394/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1197.30631.12387.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Enabling the 'hidden' option for analyzed file
Moving of the original file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe obfuscated packed
Link:
https://www.filescan.io/uploads/620a710e289e2f3e4fd99d9c/reports/5e8b0b9d-87fd-48ab-8e47-4187aab2878f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/869fbc3c-0961-49e6-9e14-a40513879f29
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/939680
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a3c57266f4f2f229c35a60c0c07914b8029d22f4e258288b296b3e2669e1d566/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-14 15:11:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=upcxezxu6lzctq22mdama6iuxabj2ixu4jmcrczjnm7cm2pb2vta._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
03735ed519d86a5d8456393b63d97be01c426c4b441c49efd2fd010c5faf78ce
Loki
12f56e0170dd0bd765e935c0709c11a32cf916a9f1f12028e9af123c0a23b8a4
Loki
32c63a9d1cee41eac6f20e8661fdcf296058c8012938746fa73e7bf903e05e66
Loki
4dd4e59368f5e310bdebc4f7ee60778446873c9b930f16366592b471a86f3718
Loki
727610ecf5d6c090e8b2ff1ae1198a587429521d215ffefb91069ff2bff72353
Loki
7fe467ef6f392039c0ce5edaadf85c19a8406a0b0b7332131e2b2ddc9f074bb6
Loki
bb8e5543df945a55653a320f95ac3f81a8b266ca788fa800139c61a1d5c88549
Loki
bc4e9db6c6cc42bb03d7257abbf2105e1ed6c4fe24ccaabcd3db84fe8a935c1b
Loki
e02e76b801c04fa9909a938660de5a477fded8303b54d7a51f6a5bb2a8177398
Loki
+ 6'883 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/220214-sklp6shec5/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://secure01-redirect.net/gc18/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
3ca74eb4ce4c2c5604dc298949ae47996d93063abfde0682d689205561d17d44
MD5 hash:
4e35b541f3d9162d0ac93d336df67779
SHA1 hash:
bb9e65761186806d4bada659e9d5db0c070501d4
Link:
https://www.unpac.me/results/32eb3243-c90a-4de2-bcd9-f34f8b0d6e20/
SH256 hash:
ba49c3bdde13b8b92057d6839eac94fa266b5367a15eed308fae32c18aa6cbdd
MD5 hash:
e525aef25881dfa5b223679c5e2f417b
SHA1 hash:
97c704d70efdc7d6b31c7e9eb14de9a76f5a51a5
Link:
https://www.unpac.me/results/32eb3243-c90a-4de2-bcd9-f34f8b0d6e20/
SH256 hash:
ff8e3c85da0e32536ac75e5fb6551d077e9f439a666008599027a029afe2700a
MD5 hash:
d6ce80bdb36a5b500757782d25adfe84
SHA1 hash:
59eb48e78ed850775416ab45b4fef29c6c67fc73
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/32eb3243-c90a-4de2-bcd9-f34f8b0d6e20/
Parent samples :
dbd1b3465a3746f93c488b274735409b1c2f21d2da33818fa03332b9899bdeaa
a3c57266f4f2f229c35a60c0c07914b8029d22f4e258288b296b3e2669e1d566
SH256 hash:
89cf79856773db92aa2f8708e6b39104928f70a62cd4071eea5e35354e81c841
MD5 hash:
6f254cb3c567a307bbcfb4d197b5ac7f
SHA1 hash:
34ab0167e5dd3ff84c92f6d48b40b5334b08cd5d
Link:
https://www.unpac.me/results/32eb3243-c90a-4de2-bcd9-f34f8b0d6e20/
SH256 hash:
a3c57266f4f2f229c35a60c0c07914b8029d22f4e258288b296b3e2669e1d566
MD5 hash:
61cfd4abd701e3d5e2d482f170a839ed
SHA1 hash:
41a9fc240746155357201ebe0a60e765e8f84137
Link:
https://www.unpac.me/results/32eb3243-c90a-4de2-bcd9-f34f8b0d6e20/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a3c57266f4f2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/a3c57266f4f2f229c35a60c0c07914b8029d22f4e258288b296b3e2669e1d566

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Executable exe a3c57266f4f2f229c35a60c0c07914b8029d22f4e258288b296b3e2669e1d566

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/241394/

Comments