MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4182d8f62fb365856798683af6277ad0c3b3a9d9788fe1e2cef07bb918197d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 16

Intelligence 16 IOCs YARA File information Comments 1

SHA256 hash:	a4182d8f62fb365856798683af6277ad0c3b3a9d9788fe1e2cef07bb918197d6
SHA3-384 hash:	bbe15a7fbd2e869212b909b85ca097a194b8b9dbb6026c7df014d49d9b13ac7afcbd73fa53cc294c0a0324942f820beb
SHA1 hash:	7337b819dfae38bf80dfb174fa3ae9929cda3d79
MD5 hash:	8083bba388194bb9674cf7011a596dd7
humanhash:	utah-eleven-kansas-cup
File name:	8083bba388194bb9674cf7011a596dd7
Download:	download sample
Signature	Loki Create hunting rule
File size:	250'880 bytes
First seen:	2022-03-01 09:25:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	cc5860ebf1cc8027858fa120fb15d15c (2 x RedLineStealer, 1 x Gozi, 1 x Loki)
ssdeep	3072:eVDMyNKxjC0GNImGDiIPHNH2G6bh+lOHS0Jt1gZ5BojukWv:ofosaHNHlR50P1Tj5Wv
Threatray	6'609 similar samples on MalwareBazaar
TLSH	T10934D0127690C472C4873570447BCBFD6A7AF831C6A5894BB7A83B6E2F303D2677521A
File icon (PE):
dhash icon	38b078cccacccc43 (123 x Smoke Loader, 83 x Stop, 63 x RedLineStealer)
Reporter	zbetcheckin
Tags:	32 exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

218

Origin country :

n/a

Vendor Threat Intelligence

Detection:

LokiBot

Link:

https://www.capesandbox.com/analysis/245666/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Reading critical registry keys

Changing a file

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for analyzed file

Stealing user critical data

Moving of the original file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/7708/overview

Behaviour

SystemUptime

MeasuringTime

EvasionGetTickCount

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/621de6b1b94fb38cb42d0536/reports/7f315ff3-e4ab-4ce8-ab78-1c9ea295cdec/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/015b0c7a-59ec-4d85-9a15-c5fe7dba97e1

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/948050

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/a4182d8f62fb365856798683af6277ad0c3b3a9d9788fe1e2cef07bb918197d6/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2022-03-01 09:26:13 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 28 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=uqmc3d3c7m3fqvtzq2b26ytxvugdwou5s6ep4hrm54d3xembs7la._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Loki

1fe92b0962f5725a3a8fafd00d85d636f46dfd84582a1f21e2286610a7feb3a0

Loki

6f975378cb65fa40e27b22cd6676e4385b46cdb0df3111cb94530a8615516281

Loki

8736334fb15c7ff407900e746c9a3a0d2db66226d15c28fa3151f09604f84b89

Loki

fc3f900e33a9964aac54740bc6f95b506599c0b05aaeba262c10f5bd846d05d0

Loki

+ 6'599 additional samples on MalwareBazaar

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220301-ld7kqsbabj/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

outlook_office_path

outlook_win_path

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://164.90.194.235/?id=22044231991792986
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php