MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a40d51f510b1b3687bade10d6c2e2afd922914f19bca239788281422fe03aeef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 14

Intelligence 14 IOCs YARA File information Comments

SHA256 hash:	a40d51f510b1b3687bade10d6c2e2afd922914f19bca239788281422fe03aeef
SHA3-384 hash:	01f02b68f38e03ad0cfb0aef9d888306e33e7fd6891812580c2cdfdb0bd7db203b2236aa55ad0428d40b66be6967f1e4
SHA1 hash:	5b4f7d6e1af2af75e9cdeb011dfacede71ccf278
MD5 hash:	399b01695c79b382f13cd4cac008547c
humanhash:	lemon-pip-robin-colorado
File name:	triage_dropped_file
Download:	download sample
Signature	Loki Create hunting rule
File size:	249'698 bytes
First seen:	2021-10-20 12:41:00 UTC
Last seen:	2021-10-20 14:07:12 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep	6144:wBlL/cTo0vbBCqshZoAvjL6iWQTODHhmzaf4u0VuWGjQ:CeTo0vbBioSjJTO0Wf4HMa
Threatray	5'156 similar samples on MalwareBazaar
TLSH	T1A534121673D288B7C19B1EB2AEB78655D3B6D6041225674F8770EF7F1A325C3CC4A282
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	malwarelabnet
Tags:	exe Loki Lokibot

Intelligence

File Origin

# of uploads :

# of downloads :

450

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/198835/

Detection(s):

SecuriteInfo.com.Trojan.Siggen15.28370.26340.6137.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file

Unauthorized injection to a recently created process

Reading critical registry keys

Changing a file

Replacing files

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Stealing user critical data

Moving of the original file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/61700e619a5a1e91c5c7f015/reports/015e680a-071b-4338-a538-267a44e99d28/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fc9ea1f8-cd61-4d34-b436-318fbee5550d

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/873874

Signature

Antivirus detection for dropped file

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/a40d51f510b1b3687bade10d6c2e2afd922914f19bca239788281422fe03aeef/

Threat name:

Win32.Backdoor.Androm

Status:

Malicious

First seen:

2021-10-20 11:11:11 UTC

AV detection:

15 of 37 (40.54%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=uqgvd5iqwgzwq65n4egwylrk7wjcsfhrtpfchf4ifakcf7qdv3xq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/211020-pwrtsahhhl/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Loads dropped DLL

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://63.250.40.204/~wpdemo/file.php?search=719442
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php