MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5fb63409bbc68224d3e2be7511cc6a49fd205892813890c3a76feeabd5a5e56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5fb63409bbc68224d3e2be7511cc6a49fd205892813890c3a76feeabd5a5e56
SHA3-384 hash: 124074df9273ab5146e199c5debf39eedbac5a86070b353251ed46f1ed5975e5dfcd7c13ab19f86125f65cefd14347f0
SHA1 hash: 67012101fc376e2e747e1a4edcec20f1ff267998
MD5 hash: 6b42430efe73adec550a6fdf4d1977ac
humanhash: bacon-mockingbird-magazine-quiet
File name:Shipment 05 Note.exe
Download: download sample
Signature Loki
Create hunting rule
File size:61'440 bytes
First seen:2021-04-29 23:40:48 UTC
Last seen:2021-04-30 00:03:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e9c9ee7bc1977027f5b9649a61cb199a (1 x Loki)
ssdeep 768:0ciYmKC3guMzAs/3ga9He6ex8lAzdw5cFTQ2no:a33OMs/QI+ZxzqcFkJ
Threatray 1'044 similar samples on MalwareBazaar
TLSH 4A532902B1EAF536E2048EB60D7947EA815B7CA015209D07B57CBE393E3A9077521B7F
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://techarnise.ru/fc2/fre.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://techarnise.ru/fc2/fre.php https://threatfox.abuse.ch/ioc/26531/

Intelligence

File Origin
# of uploads :
2
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Guloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/147017/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Unauthorized injection to a recently created process
Modifying a system executable file
DNS request
Creating a file
Reading critical registry keys
Changing a file
Replacing files
Connection attempt
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Stealing user critical data
Moving of the original file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/703421
Signature
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Potential malicious icon found
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5fb63409bbc68224d3e2be7511cc6a49fd205892813890c3a76feeabd5a5e56/
Threat name:
Win32.Infostealer.PonyStealer
Create hunting rule
Status:
Malicious
First seen:
2021-04-29 23:13:52 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ux5wgqe3xrucetj6fptvchggusp5ebmjfajysdb2o37ovpk2lzla._file
Verdict:
malicious
Similar samples:
22b13820a6139c7682d5e1108aefde2200dc593e14fe7fca28eb27d5e616bef7
Loki
37fba5e93049ee78ac1fdf1fafe945636680193ddcb1dc9533f2c9ac80d3744c
Loki
479f929625a3e8a8f98256c3a020f5946e0d88fd7e3582e47b63500679d46585
Loki
522735989689a96d0e10e926aae941e58a695062254573c5796bb129e4c7703e
Loki
5c2766a9b8df935b6144459c3ae5c8f6b7cab54ab844cc78ae770ed1481c4220
Loki
6147decc439b9d258f5b19f77dfa47ea441e681c49e0b699533eea18104f4092
Loki
6e6fa2f1d1b7e3c37b6c7a18a4bd750e6ca980741c87af931c17d2ed7e469c3e
Loki
93ff33867e6593f0e5a80ba261665c6f162bceed6cb39362811a70aa6561cf11
Loki
c63a3f86be406a11e8f7760403e407a97441753205f8cef432fd634856ca2992
Loki
d75c69a49a30595964989b72499ec0e303ff42a0e2a334dda22a9cd9fd7e8ba5
Loki
+ 1'034 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210429-2we2b5qc5e/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Checks QEMU agent file
Lokibot
Malware Config
C2 Extraction:
http://techarnise.ru/fc2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
49b04162c412105ab0857de16713724cbf3234a0b6ba51f3a5286312633f20c3
MD5 hash:
1f1b425190b2fb0396ad2d538b1060ba
SHA1 hash:
413f98641d46fdcabfcaf64f29495667de6282ea
Link:
https://www.unpac.me/results/f810ddbb-3b32-4d3d-9757-ac422fc95380/
SH256 hash:
a5fb63409bbc68224d3e2be7511cc6a49fd205892813890c3a76feeabd5a5e56
MD5 hash:
6b42430efe73adec550a6fdf4d1977ac
SHA1 hash:
67012101fc376e2e747e1a4edcec20f1ff267998
Link:
https://www.unpac.me/results/f810ddbb-3b32-4d3d-9757-ac422fc95380/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a5fb63409bbc68224d3e2be7511cc6a49fd205892813890c3a76feeabd5a5e56

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/147017/

Comments