MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aec10fce36e0391d18a9d4a854c1f72b853e9d8c8dde0b5b17485734b0bdcac3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	aec10fce36e0391d18a9d4a854c1f72b853e9d8c8dde0b5b17485734b0bdcac3
SHA3-384 hash:	8dc8b9bd8021af8a52764fb9da11a72a39f1a0ce1be1ae81f6eea11cb68fdc0ace279b6c4e54c32192c7bcf42f8b733d
SHA1 hash:	e823255a149b8b5c8a9e7fa5c6fbab9c16e79f23
MD5 hash:	c71f4037ec2e16087c9b30ffa62e97a7
humanhash:	helium-mars-oven-east
File name:	Shipping documents.rar
Download:	download sample
Signature	Loki Create hunting rule
File size:	398'566 bytes
First seen:	2022-04-14 06:11:47 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:WhB/x+z8ox/t6ayenz0AnyyCdbgxYKQOdnOSTVEzAQtg94T2g+ujDTO2svb5aNWL:WT/AVLnYAn0shESTGEEJtCIe4UMFC
TLSH	T1908423E72A9C5F244905CD275732F7F5AB88C336D31562A6E3FC592A3090419CB3E0AB
Reporter	cocaman
Tags:	Loki rar Shipping

cocaman

Malicious email (T1566.001)
From: "Selva Kumar <selva@38.fmfdstu.cfd>" (likely spoofed)
Received: "from hp0.38.fmfdstu.cfd (hp0.38.fmfdstu.cfd [143.198.38.44]) "
Date: "Tue, 12 Apr 2022 21:28:15 -0700"
Subject: "RE:Shipment Documents"
Attachment: "Shipping documents.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

244

Origin country :

n/a

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fareit obfuscated packed replace.exe update.exe

Link:

https://www.filescan.io/uploads/6257bb38ffe27d5119cad75d/reports/6aaf7cb0-b628-445a-9a2b-d949b8b4a968/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aec10fce36e0391d18a9d4a854c1f72b853e9d8c8dde0b5b17485734b0bdcac3/

Threat name:

ByteCode-MSIL.Trojan.LokiBot

Status:

Malicious

First seen:

2022-04-13 06:21:02 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 25 (64.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=v3aq7trw4a4r2gfj2sufjqpxfoct5hmmrxpawwyxjbltjmf5zlbq._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220414-gx6qbshcgl/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://164.90.194.235/?id=17642814389135937
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/aec10fce36e0391d18a9d4a854c1f72b853e9d8c8dde0b5b17485734b0bdcac3