MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b10ac6368ee3c8996225a455a213cbafad3a361e093960401d0ac54f8a1db5cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 15


Intelligence 15 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b10ac6368ee3c8996225a455a213cbafad3a361e093960401d0ac54f8a1db5cc
SHA3-384 hash: 2e61b1db85d72f33f3ba68e51bb5f33528a11d306e464e97f353f92b5a3d0bce730257f7002e13797c08255855cc741c
SHA1 hash: 5e60718c4927110e4adaa80bf2f20159a4004c83
MD5 hash: e77c90e8ff96196b410f6c0868307f6f
humanhash: lemon-india-pip-kitten
File name:DHL Expres Shipment documents.exe
Download: download sample
Signature Loki
Create hunting rule
File size:729'088 bytes
First seen:2023-06-16 11:19:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:3Nlta2iNx5LbzIu9+r9CKOp5FevqMiikyPfXKvmuwu2QJnDIAOvJTYR2:da1j5LA9WpaqMiiRzNu2QJUzvJTe2
TLSH T147F4020022D9CB2AC57F07F6854026308776A367F577D7260DC3B4FA1E62BD2519EA8B
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter abuse_ch
Tags:DHL exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
344
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
DHL Expres Shipment documents.exe
Verdict:
Malicious activity
Analysis date:
2023-06-16 11:29:16 UTC
Tags:
trojan lokibot
Link:
https://app.any.run/tasks/7d461870-fe82-4005-9010-8ecadb119fd7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/399468/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Enabling the 'hidden' option for analyzed file
Moving of the original file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
floxif packed threat virus
Link:
https://www.filescan.io/uploads/648c4565e8a7749a2a22586f/reports/1b8cfed9-3869-46a8-887f-1aea9f55d39b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/b10ac6368ee3c8996225a455a213cbafad3a361e093960401d0ac54f8a1db5cc
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/73a95143-92a9-4556-a6b8-d89c3c740a94
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1255968
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b10ac6368ee3c8996225a455a213cbafad3a361e093960401d0ac54f8a1db5cc/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2023-06-16 01:11:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
17 of 36 (47.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wefmmnuo4pejsyrfurk2ee6lv6wtunq6be4waqa5blcu7cq5wxga._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/230616-nfezlsef96/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://161.35.102.56/~nikol/?p=61353
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
6aa48d8fdb6babfa13fffd0fb7f7fc0222a3f87ceeedeed57b1021b817f35050
MD5 hash:
6d70c1d5150558ec57293ef064442671
SHA1 hash:
bdf661ea5b5f75081c8c5c38a713f8ecda889b1a
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
Link:
https://www.unpac.me/results/4056182a-5c15-48db-ae28-8c085397ccc2/
Parent samples :
b10ac6368ee3c8996225a455a213cbafad3a361e093960401d0ac54f8a1db5cc
25fcbdb67d14b109af5408df8c9b78305c41afeb8ad3707147c7c350a0535330
fc15e945d8f642f13960c48e212d2cbff3e9e3890cbac0b17ace14273cac0458
b55d2b174334aeb67e0568c3b9262fa719382647326eb5428fdcff753b9a7643
e9cd9696e6bf493ed5be1c9099a5181593f585aaccb80397f02e6311ee3766e9
03b5b853e3e2fae29872f7f2f4d278d8feffb431d210a8c6b458053987d4fa00
SH256 hash:
d6d62867580dc9d28d4e47aa4b479916e7c1167f0700a56ae0da9d2d6f311308
MD5 hash:
6b9c9191a8e10ade40d8ab7eb5caeb92
SHA1 hash:
7fc053f77f020c18fea92701b171f049159a08d9
Link:
https://www.unpac.me/results/4056182a-5c15-48db-ae28-8c085397ccc2/
SH256 hash:
b86193f0f5eeadf451f23596dffb4d015245311c67bc15244c2b1c81293d3679
MD5 hash:
be09d1a9fbdc7fe4ad47e49a0ccf2a0e
SHA1 hash:
3eea7d856de59fefd670110c2edda63c319a5a1b
Link:
https://www.unpac.me/results/4056182a-5c15-48db-ae28-8c085397ccc2/
SH256 hash:
afe56d9882121c425cf8c2d2d1eacdababd4d817aba6a0da28d407cf6fa7b956
MD5 hash:
138173ebd827c364efe319033b3ecaf9
SHA1 hash:
1f3e72751e84ba32a4fd148a3d5572c6e9db530f
Link:
https://www.unpac.me/results/4056182a-5c15-48db-ae28-8c085397ccc2/
SH256 hash:
2af3937d666ddb39eaaa7b3b4420ee896fb5d983fb11c43a2078135103877517
MD5 hash:
cfa1c170a32d938383d1e1c34649421d
SHA1 hash:
1637e1e62acd0bfe65e9ef9ea2e895cbb5bd8d2f
Link:
https://www.unpac.me/results/4056182a-5c15-48db-ae28-8c085397ccc2/
SH256 hash:
b10ac6368ee3c8996225a455a213cbafad3a361e093960401d0ac54f8a1db5cc
MD5 hash:
e77c90e8ff96196b410f6c0868307f6f
SHA1 hash:
5e60718c4927110e4adaa80bf2f20159a4004c83
Link:
https://www.unpac.me/results/4056182a-5c15-48db-ae28-8c085397ccc2/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b10ac6368ee3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/b10ac6368ee3c8996225a455a213cbafad3a361e093960401d0ac54f8a1db5cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:LokiBot
Create hunting rule
Author:kevoreilly
Description:LokiBot Payload
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:Windows_Trojan_Lokibot_0f421617
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Lokibot_1f885282
Create hunting rule
Author:Elastic Security
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/399468/

Comments