MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5aa202ad0d5bce164776499d03b5c1ba17fafb4dbe6eb07bb0c8c357b27745d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 14

Intelligence 14 IOCs YARA 2 File information Comments

SHA256 hash:	a5aa202ad0d5bce164776499d03b5c1ba17fafb4dbe6eb07bb0c8c357b27745d
SHA3-384 hash:	375bb054a4acb8a03d07c6b711484bf9b029b05cd832e1eabc43ae268812609e6fb8b8326031e5992fb3c7e067cfc2e5
SHA1 hash:	51517123dd98e024a46ea5e815fae0c78ab754f2
MD5 hash:	aa06fdda2ee9d62b0dbf3fecadd9d789
humanhash:	high-fanta-berlin-lithium
File name:	33690120220531MES_S Quote.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	835'584 bytes
First seen:	2022-11-30 09:53:57 UTC
Last seen:	2022-11-30 11:31:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'245 x AgentTesla, 20'500 x Formbook, 12'374 x SnakeKeylogger)
ssdeep	12288:qT3vqU+tbjJXPpw/mwkUwqAngpC3eRYqWXSVmmZCSmDdzoa1cfN:k3objJi/3k8AgpC3emdSVmICSmDdEPf
TLSH	T1AE05DF803366AF71F539A7F23521904827763C6E95F1C2296DDEB0DE26B2B4049F1B27
TrID	63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	TeamDreier
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

170

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

lokibot

ID:

File name:

33690120220531MES_S Quote.exe

Verdict:

Malicious activity

Analysis date:

2022-11-30 09:55:52 UTC

Tags:

trojan lokibot

Link:

https://app.any.run/tasks/30850b3a-64f4-40bc-b40a-1bc2c99bfde8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/340010/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.389.15411.31903.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Enabling the 'hidden' option for analyzed file

Moving of the original file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6387283b559d07a06f48b4d0/reports/d96f2d1e-6563-4569-a65f-1abede4206be/overview

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/707e6755-83ed-481f-a84a-471b34c782c9

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1123813

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a5aa202ad0d5bce164776499d03b5c1ba17fafb4dbe6eb07bb0c8c357b27745d/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-11-29 07:00:18 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

30 of 41 (73.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uwvcakwq2w6oczdxmsm5ao24doqx7l5u3ptowb53bsgdk6zhoroq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/221130-lw7y8acg9t/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://sempersim.su/gm18/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/d7724fe9-e54b-4baa-9b74-2a6065e79dae

Unpacked files

SH256 hash:

e48cb8234ba0d3a8116c1305ad808fe0927e5c21d36689ebbc9542914d8f492c

MD5 hash:

0e36cc3a73e638c5d1d567c034d5eb68

SHA1 hash:

f68c02c0f5e34a0479816fa2774b7974d663e072

Link:

https://www.unpac.me/results/8453833e-4495-47c5-bc25-56c76be42825/

SH256 hash:

3624268b1bf67fd3f560f345e5171f3a2f8968a776c23816ea76fc0ef41b0f03

MD5 hash:

1619753b625e58c25b73fbf1f0bff482

SHA1 hash:

c0d7922bdbc10ef0ee1606a40c2dedd22cb180d4

Link:

https://www.unpac.me/results/8453833e-4495-47c5-bc25-56c76be42825/

SH256 hash:

e90af4372fe3776a2a78ebe85669a8f25d032e94529793a1d9944024075835f1

MD5 hash:

25a05315505fef30138626ed938f9a46

SHA1 hash:

329e4339c57a64b0e04c5c214adb6d963342f6f7

Detections:

lokibot

win_lokipws_auto

win_lokipws_g0

Link:

https://www.unpac.me/results/8453833e-4495-47c5-bc25-56c76be42825/

Parent samples :

b1aa0b5c10d7fe23e10ae6796fd1f83b8772d4e5257a80f7bc7cf96222166887
db6447285cc62411bca5539614e04afe68702e4e0841f609ead269d2c3869074
a5aa202ad0d5bce164776499d03b5c1ba17fafb4dbe6eb07bb0c8c357b27745d
572429f481ab1b11e98a4a14f149947a856061805fb77dd944eeb909ca88854c
e19ba4209c74fd2386e3c1fcdd510b7fe14851eb0b94133edddc862f1f35b2f8

SH256 hash:

340ba2312d5cdfc3d89f3f35f627187dcb406e5afea134bc76b04f52f4285df3

MD5 hash:

85f9290aa8900e9fd74b01ee23125706

SHA1 hash:

310eb5e4aea5471b74a6385f1da283b9d8e3d698

Link:

https://www.unpac.me/results/8453833e-4495-47c5-bc25-56c76be42825/

SH256 hash:

c8ee452af0d982f35188984561183e622a8d8d99645099d97bdec4f164b051a8

MD5 hash:

919983c675d038ac1de0c59156730e70

SHA1 hash:

0dd6dc125327208ed95540c32bed6e31078f0858

Detections:

lokibot

win_lokipws_auto

Link:

https://www.unpac.me/results/8453833e-4495-47c5-bc25-56c76be42825/

SH256 hash:

a5aa202ad0d5bce164776499d03b5c1ba17fafb4dbe6eb07bb0c8c357b27745d

MD5 hash:

aa06fdda2ee9d62b0dbf3fecadd9d789

SHA1 hash:

51517123dd98e024a46ea5e815fae0c78ab754f2

Link:

https://www.unpac.me/results/8453833e-4495-47c5-bc25-56c76be42825/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/a5aa202ad0d5bce164776499d03b5c1ba17fafb4dbe6eb07bb0c8c357b27745d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

exe a5aa202ad0d5bce164776499d03b5c1ba17fafb4dbe6eb07bb0c8c357b27745d

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/340010/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample