MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b07a833d67de436ef2f5f9de15d3dcce8abd1c3cdd440282297dedb68529a22e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Loki
Vendor detections: 12
| SHA256 hash: | b07a833d67de436ef2f5f9de15d3dcce8abd1c3cdd440282297dedb68529a22e |
|---|---|
| SHA3-384 hash: | 7b6d4c9c46923ece7078315a9eb3ca1cebf5ed14d9f8b8c4207d8582e9a8945bda33134722b91daffbaeb4ab5e099d2c |
| SHA1 hash: | 308d9c28376e84fbe3e89dd0c45b88ee4ab23ad0 |
| MD5 hash: | 2b85442faeb58adff1a8824c9fced12b |
| humanhash: | timing-white-autumn-dakota |
| File name: | vbc.exe |
| Download: | download sample |
| Signature | Loki |
| File size: | 237'154 bytes |
| First seen: | 2022-04-04 08:58:46 UTC |
| Last seen: | 2022-04-04 13:02:44 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 56a78d55f3f7af51443e58e0ce2fb5f6 (719 x GuLoader, 451 x Formbook, 295 x Loki) |
| ssdeep | 6144:HNeZmbWXqeVBYl/e86YvbO9WYSh0rwM6XBLY5:HNlMq26lm86YvbgWY6owMaW |
| Threatray | 7'207 similar samples on MalwareBazaar |
| TLSH | T11134128438B4C5E7EA5242712E3D97B66EFEFE2520659F4A0320DF5D3924782C10F72A |
| File icon (PE): |  |
| dhash icon | b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla) |
| Reporter |  pr0xylife |
| Tags: | exe Loki Lokibot |
Intelligence
File Origin
# of uploads :
3
# of downloads :
411
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://192.3.247.131/001/vbc.exe
Verdict:
No threats detected
Analysis date:
2022-04-04 12:14:34 UTC
Tags:
opendir loader
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Сreating synchronization primitives
Reading critical registry keys
Changing a file
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Enabling the 'hidden' option for recently created files
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Sending an HTTP POST request to an infection source
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
control.exe formbook overlay packed python shell32.dll threat
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Lokibot
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.LokiBot
Status:
Malicious
First seen:
2022-04-04 03:40:44 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
19 of 26 (73.08%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Similar samples:
+ 7'197 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Score:
10/10
Tags:
family:lokibot collection spyware stealer trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Loads dropped DLL
Reads user/profile data of web browsers
Uses the VBS compiler for execution
Executes dropped EXE
Lokibot
Malware Config
C2 Extraction:
http://62.197.136.176/userbob/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
173015bc9608f48545ec78e0189913ad1687b8b3890f7216e2caa3bb01b131ef
MD5 hash:
11aa8c01c852c5cf65dac3842764b632
SHA1 hash:
e9613151d209ee96532df2b5d71c0f8fd81df1d9
Detections:
win_lokipws_g0
win_lokipws_auto
Parent samples :
f56b737580b2d9b2a379cb016217827323a8290d9a3af96b643897c7de92bf77
e85188612aa3a2ae2cdedcf14fc707bd4730351f4d5e0895b68f6f74c401f92c
ae90d22f9ce84c653c4f89222ca85ac819c11a93ca3a720f4968666b8d14d488
283011e02f08ea4c1dfbf76d7322d2034ad3cbe6f0a839267adcfe2a56fcb2a3
b07a833d67de436ef2f5f9de15d3dcce8abd1c3cdd440282297dedb68529a22e
84279034085e5bc35a73aa8cffffcbaa49f560944125eb547524733a806cfd8f
b231f8e6f660efe916459e41e353449e4840edc57b15a308d1fcad833cedafc7
43c7f5fc7cfab29fae6e20f34e252bafc625d1498864cccf0450a2bb279f1df4
378f9b092b0ef255bfc83189a18d1fa6caf5245bddaf4bfb98236cdbc66fc277
e85188612aa3a2ae2cdedcf14fc707bd4730351f4d5e0895b68f6f74c401f92c
ae90d22f9ce84c653c4f89222ca85ac819c11a93ca3a720f4968666b8d14d488
283011e02f08ea4c1dfbf76d7322d2034ad3cbe6f0a839267adcfe2a56fcb2a3
b07a833d67de436ef2f5f9de15d3dcce8abd1c3cdd440282297dedb68529a22e
84279034085e5bc35a73aa8cffffcbaa49f560944125eb547524733a806cfd8f
b231f8e6f660efe916459e41e353449e4840edc57b15a308d1fcad833cedafc7
43c7f5fc7cfab29fae6e20f34e252bafc625d1498864cccf0450a2bb279f1df4
378f9b092b0ef255bfc83189a18d1fa6caf5245bddaf4bfb98236cdbc66fc277
SH256 hash:
396826bd57f856e440566ade243af68d695ff28e1bdabd9c56aa1f18ff89bca6
MD5 hash:
26fee3df0d16bda44ccbb49cd41aaa3c
SHA1 hash:
8cafe9d16d5471445cbae76a3590953d0ef39009
SH256 hash:
b320df6a59f23775ecade3fb64bda02909e737c8094d3f30be1a5a2069500ba1
MD5 hash:
39f181c7e33e83c5e76432b8ef5c8d38
SHA1 hash:
d1d3dd81e55dc5e5dcfaceb4b753f599f6941c77
SH256 hash:
b07a833d67de436ef2f5f9de15d3dcce8abd1c3cdd440282297dedb68529a22e
MD5 hash:
2b85442faeb58adff1a8824c9fced12b
SHA1 hash:
308d9c28376e84fbe3e89dd0c45b88ee4ab23ad0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many file transfer clients. Observed in information stealers |
| Rule name: | INDICATOR_SUSPICIOUS_GENInfoStealer |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables containing common artifcats observed in infostealers |
| Rule name: | infostealer_loki |
|---|
| Rule name: | infostealer_xor_patterns |
|---|---|
| Author: | jeFF0Falltrades |
| Description: | The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads. |
| Rule name: | Loki |
|---|---|
| Author: | kevoreilly |
| Description: | Loki Payload |
| Rule name: | LokiBot |
|---|---|
| Author: | kevoreilly |
| Description: | LokiBot Payload |
| Rule name: | malware_Lokibot_strings |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect Lokibot in memory |
| Reference: | internal research |
| Rule name: | MAL_Lokibot_Stealer |
|---|---|
| Description: | Detects Lokibot Stealer Variants |
| Rule name: | STEALER_Lokibot |
|---|---|
| Author: | Marc Rivero | McAfee ATR Team |
| Description: | Rule to detect Lokibot stealer |
| Rule name: | win_lokipws_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.lokipws. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.