MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7caf561ebd9126ca68fb1eb8f9acbcf34cc89c15e346c55f06d56af81a6081c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7caf561ebd9126ca68fb1eb8f9acbcf34cc89c15e346c55f06d56af81a6081c
SHA3-384 hash: 140a4ae60d2e8b2e4bd0b019ae88d9f95c0e6850a83be683316f7aa2670780907d03d19ef2fe76d625bf59824b7ee8d4
SHA1 hash: f12ee94da23836a02674c8ff6784ea2501110c13
MD5 hash: c9138db226a02310ce9d9e63a776424f
humanhash: quebec-illinois-twenty-grey
File name:New Order.iso
Download: download sample
Signature Loki
Create hunting rule
File size:1'966'080 bytes
First seen:2021-07-06 15:57:14 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:gkFJaIMVjLz7TLGiOcez3gVZsZZZsZYJsvHIq26+7r9V65xKXZVvo9lXOH6Y88ve:HiO1aWF7reXKLvJ7yQafnfF
TLSH CA959D3576729F91D87FC7384331E13C4FB9AE66E207E2B56CD8389B64B0B410A56623
Reporter cocaman
Tags:iso Loki


Avatar
cocaman
Malicious email (T1566.001)
From: "sales@alumate.com.tw" (likely spoofed)
Received: "from alumate.com.tw (unknown [103.155.80.90]) "
Date: "6 Jul 2021 07:16:27 -0700"
Subject: "Purchase Order-734343433"
Attachment: "New Order.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen14.27013.25376.19265.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a7caf561ebd9126ca68fb1eb8f9acbcf34cc89c15e346c55f06d56af81a6081c/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-07-06 15:58:22 UTC
File Type:
Binary (Archive)
Extracted files:
57
AV detection:
6 of 45 (13.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u7fpkypl3ejgzjupwhvy7gwlz42mzcobly2gyvpqnvlk7angbaoa._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210706-w5v6a62nvn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://185.110.190.5/gugufdre.php/auJMYiGBL7JHG
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a7caf561ebd9126ca68fb1eb8f9acbcf34cc89c15e346c55f06d56af81a6081c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

iso a7caf561ebd9126ca68fb1eb8f9acbcf34cc89c15e346c55f06d56af81a6081c

(this sample)

Loki

Executable exe 8a0ad791edcb0ee362e6013e5b86204205b5869aae17294f14047ed26f1dddd2

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8a0ad791edcb0ee362e6013e5b86204205b5869aae17294f14047ed26f1dddd2
  
Dropping
Loki

Comments