MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b0fd06eb989e91464f06adbe44109286942dd3fff9b8a20b627a4e2294e25e42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Loki
Vendor detections: 17
| SHA256 hash: | b0fd06eb989e91464f06adbe44109286942dd3fff9b8a20b627a4e2294e25e42 |
|---|---|
| SHA3-384 hash: | d705723eb9a7c0f8ef4e50551efd5d4c42886acee8bd1c12939450b8cbf62f62e588c5abfc5a0b991a34bef6a87ce71f |
| SHA1 hash: | 0aa8c63b584f83ddd58b490915a60bf085c67528 |
| MD5 hash: | 0744eccf5d93cf89589d70ea7a164506 |
| humanhash: | kilo-bravo-louisiana-california |
| File name: | 0744eccf5d93cf89589d70ea7a164506 |
| Download: | download sample |
| Signature | Loki |
| File size: | 677'376 bytes |
| First seen: | 2023-06-11 22:44:16 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 12288:VxPWR28Le0cY+Yg9fb9Ton+K6euQMhCfh4ooWWl3XrEnk:V1+xL9Rk9en+Kzu7AZ4oilQk |
| TLSH | T1EBE4127E17B3896EC8C73FBC8C112EB2D1E856867527D6478FA3FD99DD80A080C915A1 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe Loki |
Intelligence
File Origin
# of uploads :
1
# of downloads :
328
Origin country :
FRVendor Threat Intelligence
Malware family:
lokibot
ID:
1
File name:
0744eccf5d93cf89589d70ea7a164506
Verdict:
Malicious activity
Analysis date:
2023-06-11 22:46:59 UTC
Tags:
trojan lokibot
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Enabling the 'hidden' option for analyzed file
Moving of the original file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
clipbanker comodo darkkomet packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Verdict:
Malicious
Result
Threat name:
Lokibot
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Detection:
lokibot
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-06-09 05:56:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
19 of 37 (51.35%)
Threat level:
5/5
Detection(s):
Malicious file
Result
Malware family:
lokibot
Score:
10/10
Tags:
family:lokibot collection spyware stealer trojan
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://161.35.102.56/~nikol/?p=882166721559
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
aa34886c3942fe77d071d5c809831857a598a26ff82088ff84307dd035a52caf
MD5 hash:
49fea75f7ec7b667b46413632ba96736
SHA1 hash:
d499abe4fcb5f84cf471b89604ff814cc7dee9b2
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
SH256 hash:
c1b9a941f63f2278ad4c9b3fdf63a9401013103223bb68b532d0267ce4215833
MD5 hash:
744011f6722e41ca4bbe36b133421d3a
SHA1 hash:
c382f5bafe6563d4cf77a478dc0923d77e4bdc70
Detections:
lokibot
win_lokipws_auto
win_lokipws_g0
SH256 hash:
cad9d5158bd4148003f9393e3b89ea98951360112337f191af3fc7ed9d9fac34
MD5 hash:
cebb2b71aadd6adf6c4b077193e0522b
SHA1 hash:
b705fe3184e6e0a48cf7e30dbe9d1bf317e83a45
SH256 hash:
3309159d0f3510148f62849df5a693666a492a2fb47a7bf93f21032cb78f2697
MD5 hash:
9e0b2aeda0ae543f1da4f3979d2784ff
SHA1 hash:
0b5e73f0269e58844ef4e920e864b902b8498eeb
SH256 hash:
b0fd06eb989e91464f06adbe44109286942dd3fff9b8a20b627a4e2294e25e42
MD5 hash:
0744eccf5d93cf89589d70ea7a164506
SHA1 hash:
0aa8c63b584f83ddd58b490915a60bf085c67528
Malware family:
Lokibot
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://194.180.48.59/hussanzx.exe