MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1c8d5f3238ee83c78d3b8f2d8d343b520f88dd572830b101ace804cfa8a832e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments

SHA256 hash:	b1c8d5f3238ee83c78d3b8f2d8d343b520f88dd572830b101ace804cfa8a832e
SHA3-384 hash:	9a0a6e6308c25d522de47849cbe75580294ee5c5458a716d409f64dca22f36a889eb7163588309b106a5112b9af6efa4
SHA1 hash:	526ba1b96a8b412f515921c6613a31984a45bc89
MD5 hash:	54c00f07cf29e0c78061bf0563192e6e
humanhash:	chicken-burger-jig-sierra
File name:	TNT Konsinye Makbuzu.pdf
Download:	download sample
Signature	Loki Create hunting rule
File size:	652'288 bytes
First seen:	2020-10-14 16:34:05 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1ff81ad49ee0c9a950fd14cf053397db (8 x Loki, 2 x Formbook, 2 x MassLogger)
ssdeep	12288:+ffwRD4Hfx+TA6dPagGoOFGoZZvMVZEtNj+/wDQm3zSJaZIfZA7F:M4a/x+TA6dPTO4o7MviNuwZxcA
Threatray	1'628 similar samples on MalwareBazaar
TLSH	4FD49E2EE2E15533CD37163DCC0B97649C29BE603E28688E6BE71D4C5F3968D3929193
Reporter	abuse_ch
Tags:	Loki pdf TNT

abuse_ch

Malspam distributing unidentified malware:

HELO: correo.netgate.com.uy
Sending IP: 200.40.119.43
From: TNT EXPRESS <noreply@tnt.com>
Subject: TNT CONSIGNMENT NOTIFICATION
Attachment: TNT Consignment Reciept.pdf.z (contains "TNT Konsinye Makbuzu.pdf")

Intelligence

File Origin

# of uploads :

# of downloads :

179

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/70959/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

PUA.Win.Adware.Webalta-6912039-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Unauthorized injection to a recently created process

Reading critical registry keys

Changing a file

Replacing files

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Stealing user critical data

Connection attempt to an infection source

Moving of the original file

Sending an HTTP POST request to an infection source

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/491535

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b1c8d5f3238ee83c78d3b8f2d8d343b520f88dd572830b101ace804cfa8a832e/

Threat name:

Win32.Trojan.LokiBot

Status:

Malicious

First seen:

2020-10-14 07:02:33 UTC

AV detection:

27 of 29 (93.10%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=whenl4zdr3udy6gtxdznru2dwuqprdovokbqwea2z2aez6ukqmxa._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

spyware trojan stealer family:lokibot

Link:

https://tria.ge/reports/201014-ssr1vp5mjs/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://195.69.140.147/.op/cr.php/qq0L3SAjvtmMY
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php