MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0cf41eaffcc2c22c866c4cb721d763021898f74f1bdf35d4ae2711f6edf327b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 12

Intelligence 12 IOCs YARA File information Comments

SHA256 hash:	b0cf41eaffcc2c22c866c4cb721d763021898f74f1bdf35d4ae2711f6edf327b
SHA3-384 hash:	40c69dd1449e1108d280f23c722ea324d588384eb4d8d0986de368c38320a39b6491b3c0540869ed898dc319534cebc6
SHA1 hash:	853583a9010be8f4403b51ed39c51eecfd5ee2f0
MD5 hash:	2c00c7674d6c3701c78cf2a4dfb0ce3f
humanhash:	utah-mexico-pluto-emma
File name:	011876543567546_pdf.scr
Download:	download sample
Signature	Loki Create hunting rule
File size:	397'824 bytes
First seen:	2020-11-25 20:55:43 UTC
Last seen:	2020-11-30 14:25:13 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	80fca5ec032b0bbe3966043646d2c605 (1 x RemcosRAT, 1 x Loki)
ssdeep	6144:uLKqZi7AfpBLwZcjbMTVz3ujAOJQ1Phkq66GH2xz3h9ZAEGckcO0Dd:uuYi0XwZK+VzOwD6JHA3nmEBkzsd
Threatray	2'044 similar samples on MalwareBazaar
TLSH	BE84BF317492C032D26215F105B8A372567DB8210B249AEF67D46F2FBEF81CD663276E
Reporter	fabjer
Tags:	Loki

Intelligence

File Origin

# of uploads :

# of downloads :

111

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/105685/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the %temp% subdirectories

Creating a file

Running batch commands

Modifying an executable file

Unauthorized injection to a recently created process

Reading critical registry keys

Launching a process

Changing a file

Replacing files

DNS request

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Stealing user critical data

Moving of the original file

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/547580

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/b0cf41eaffcc2c22c866c4cb721d763021898f74f1bdf35d4ae2711f6edf327b/

Threat name:

Win32.Backdoor.Androm

Status:

Malicious

First seen:

2020-11-21 03:40:51 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 29 (93.10%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wdhud2x7zqwcfsdgytfxehlwgaqytd3u6g67gxkk4jyr63w7gj5q._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/201125-b92vwgn1pa/

Behaviour

Creates scheduled task(s)

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Lokibot

Malware Config

C2 Extraction:

http://qreenmaple.com/baba/baba1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php