MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 addf401c609213fb9d502c16c69845b866b88322a0d4db5526f0b0a3bc3801db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	addf401c609213fb9d502c16c69845b866b88322a0d4db5526f0b0a3bc3801db
SHA3-384 hash:	767131e22fd4ec67dcb7cdd81bb4284520f9627ab89c80c64f038d27cfc53a15534ec6ed64577074a9fc2daeff3b441c
SHA1 hash:	2df7ce995af7402a875e4190d76d3c67231cfb90
MD5 hash:	7f83593cadcacf42abe2d480303f68f2
humanhash:	don-glucose-maryland-nine
File name:	7f83593cadcacf42abe2d480303f68f2.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	948'736 bytes
First seen:	2021-09-24 06:43:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep	12288:dtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaJ9fmwCE3Li3JQ6A:dtb20pkaCqT5TBWgNQ7aJxmwxoJQ6A
Threatray	5'891 similar samples on MalwareBazaar
TLSH	T11915BE2373DE8361C3B25273BA55B711AEBF782506B1F86B2FD8093DE920121525E673
File icon (PE):
dhash icon	f096b2aaaab2b230 (4 x QuasarRAT, 2 x Loki)
Reporter	abuse_ch
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

7f83593cadcacf42abe2d480303f68f2.exe

Verdict:

Malicious activity

Analysis date:

2021-09-24 06:44:33 UTC

Tags:

trojan lokibot

Link:

https://app.any.run/tasks/0f13853f-ede0-4bc1-a320-784ebcb87233

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/191054/

Detection(s):

SecuriteInfo.com.AutoIT-3.UNOFFICIAL

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/5f0cf9e3-c61a-49cb-8ce8-8569cf83bb1d

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/857101

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/addf401c609213fb9d502c16c69845b866b88322a0d4db5526f0b0a3bc3801db/

Threat name:

Win32.Trojan.Autoit

Status:

Malicious

First seen:

2021-09-24 00:13:03 UTC

AV detection:

22 of 45 (48.89%)

Threat level:

5/5

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/210924-hgxyxsgbdp/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Uses the VBS compiler for execution

Lokibot

Malware Config

C2 Extraction:

http://silveryarmiler.sytes.net/pjohuigf/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

a14c87c836ef7fc28289fc14d32e13c97cc769836c63c3d31bf0ef80d11dcfff

MD5 hash:

050490afe388be3e24f5ce4a951eb66f

SHA1 hash:

9d2cf81ad0e9cf33647b16342547d7a0f697d868

Detections:

win_lokipws_g0

win_lokipws_auto

Link:

https://www.unpac.me/results/a352edaa-63a4-41e9-9c28-dc7ef49f657b/

SH256 hash:

addf401c609213fb9d502c16c69845b866b88322a0d4db5526f0b0a3bc3801db

MD5 hash:

7f83593cadcacf42abe2d480303f68f2

SHA1 hash:

2df7ce995af7402a875e4190d76d3c67231cfb90

Link:

https://www.unpac.me/results/a352edaa-63a4-41e9-9c28-dc7ef49f657b/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/addf401c6092/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/addf401c609213fb9d502c16c69845b866b88322a0d4db5526f0b0a3bc3801db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.