MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3f50eb98afaf1fa3611be5e129012a443fb0f7e248e8d1e2c2e395d69c4fae1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 12


Intelligence 12 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3f50eb98afaf1fa3611be5e129012a443fb0f7e248e8d1e2c2e395d69c4fae1
SHA3-384 hash: 9fe4ed935db4cba9254e7c86c4ef00381a7b4eacd93456e79bf21af44697a158da5ee50aa64e01b9c267132fefd0b6ee
SHA1 hash: a6dbb08fe9711255b712e55aec6dd0a2a78ef9ef
MD5 hash: 6c616b75c178cecf679cd9b01c628c7a
humanhash: nevada-whiskey-virginia-spaghetti
File name:6c616b75c178cecf679cd9b01c628c7a.exe
Download: download sample
Signature Loki
Create hunting rule
File size:2'283'520 bytes
First seen:2021-10-19 15:27:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:n2MVCzulOV/orI+wHGDMcqkylACKPbKCBU764ClkAZUylZkAzkAZywFjN9rEdrEK:1VCzR/orI+wHqNyA+CMq2eXNPnrEdrE
Threatray 5'682 similar samples on MalwareBazaar
TLSH T1EBB5EE87BA35FE63FD2C34F1D888D9A12E1D2E1605E3747236BBF3A986374115E00996
File icon (PE):PE icon
dhash icon 308a8a8c888a8a30 (5 x SnakeKeylogger, 4 x CobaltStrike, 3 x DBatLoader)
Reporter abuse_ch
Tags:exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
338
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/198625/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.3532.356.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/616ee4059a5a1e91c5c6c9a0/reports/09f776ce-7750-4cb9-8608-df7a56021f5f/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4bdabc19-7987-44c0-89d4-9fa6cbffe460
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/873309
Signature
Binary or sample is protected by dotNetProtector
C2 URLs / IPs found in malware configuration
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 505747 Sample: FWcm5oYNKs.exe Startdate: 19/10/2021 Architecture: WINDOWS Score: 100 45 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->45 47 Multi AV Scanner detection for domain / URL 2->47 49 Found malware configuration 2->49 51 8 other signatures 2->51 7 FWcm5oYNKs.exe 4 2->7         started        10 dfxzdg.exe 3 2->10         started        process3 signatures4 53 Tries to steal Mail credentials (via file registry) 7->53 55 Tries to delay execution (extensive OutputDebugStringW loop) 7->55 57 Injects a PE file into a foreign processes 7->57 12 FWcm5oYNKs.exe 54 7->12         started        16 cmd.exe 3 7->16         started        19 cmd.exe 1 7->19         started        59 Multi AV Scanner detection for dropped file 10->59 61 Machine Learning detection for dropped file 10->61 21 cmd.exe 1 10->21         started        23 cmd.exe 1 10->23         started        25 dfxzdg.exe 10->25         started        process5 dnsIp6 43 37.0.10.190, 49759, 49760, 49761 WKD-ASIE Netherlands 12->43 63 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->63 65 Tries to steal Mail credentials (via file access) 12->65 67 Tries to harvest and steal ftp login credentials 12->67 69 Tries to harvest and steal browser information (history, passwords, etc) 12->69 39 C:\Users\user\AppData\Roaming\...\dfxzdg.exe, PE32 16->39 dropped 41 C:\Users\user\...\dfxzdg.exe:Zone.Identifier, ASCII 16->41 dropped 27 conhost.exe 16->27         started        71 Uses schtasks.exe or at.exe to add and modify task schedules 19->71 29 conhost.exe 19->29         started        31 schtasks.exe 1 19->31         started        33 conhost.exe 21->33         started        35 schtasks.exe 1 21->35         started        37 conhost.exe 23->37         started        file7 signatures8 process9
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a3f50eb98afaf1fa3611be5e129012a443fb0f7e248e8d1e2c2e395d69c4fae1/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-10-19 15:28:06 UTC
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=up2q5omk7ly7unqrxzpbfeasurb7wd36eshi2hrmfy4v22oe7lqq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
0f7b1d33d44c2df099ebcac2627f07269bdadc33182d867a8de06dd0e8991536
Loki
18adaff885efa34c76b1159562a33d2cb869faffebcb7af0dd56c099d98a3710
Loki
4e5daccda1624bc3412f03c4876f1254f57fe07fcbfe730e5a25b4c50a29c34f
Loki
4f6d66cea6a8dcd4a29089e58d5adc3858445d4bba816fb2aa6ebc9cecfea68b
Loki
815ffebdbbd8196de95355b067f49b562237b0818c5bdce80b1e4248f1b493d6
Loki
82ced028321544147c1e5f7786aceb7037ab5e6dc418a5fb4bf2f2a075034837
Loki
875ab4a8c0e8976f706fe0417ccfdf4d78bab6c845f4b3bb5a9e79414cf34c6d
Loki
c5e30ba7109f8c474152f1a64dabe02e801f5ddc8313390954e1bbb5e04ce772
Loki
c905a0a831f688e4262c1ed829f22a286a47de8bbf954bd743f0173d58663cb1
Loki
ddedd1eb01aa4a575922cf3ffb033cc8f5829db70dd713d33cc1ebf4a6347d29
Loki
+ 5'672 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer suricata trojan
Link:
https://tria.ge/reports/211019-swbpcahadk/
Behaviour
Creates scheduled task(s)
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Executes dropped EXE
Lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://37.0.10.190/non/z/pin.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
25dbeec2ec57b760db9f46cd87967aaeed3f1cc2aba7dc304f1f4059be7fb018
MD5 hash:
416ca4db09bd93d9d3a20f1f6f61da7f
SHA1 hash:
41590adc63c54c27d00076cdbd7a70195dcfa44f
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/b8c8392b-8e92-40e8-801f-a7c09bf33967/
Parent samples :
3df3b989eee8bec7d4f9f65e865335e311bd578308cf3b53c0acc5af48bc073e
a3f50eb98afaf1fa3611be5e129012a443fb0f7e248e8d1e2c2e395d69c4fae1
SH256 hash:
a3f50eb98afaf1fa3611be5e129012a443fb0f7e248e8d1e2c2e395d69c4fae1
MD5 hash:
6c616b75c178cecf679cd9b01c628c7a
SHA1 hash:
a6dbb08fe9711255b712e55aec6dd0a2a78ef9ef
Link:
https://www.unpac.me/results/b8c8392b-8e92-40e8-801f-a7c09bf33967/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a3f50eb98afa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a3f50eb98afaf1fa3611be5e129012a443fb0f7e248e8d1e2c2e395d69c4fae1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_dotNetProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with dotNetProtector
Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe a3f50eb98afaf1fa3611be5e129012a443fb0f7e248e8d1e2c2e395d69c4fae1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1696304/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/198625/

Comments