MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3303273446384f72e2a0f90c455f69598f341164c2bcfded2cf95b30e3a9295. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3303273446384f72e2a0f90c455f69598f341164c2bcfded2cf95b30e3a9295
SHA3-384 hash: 448227de67e605a2dbba1862d2f256153e8e109edec0e06a21eece49fc91e7e54d25adbd5706fa1e636036f541c7d71d
SHA1 hash: 37c13fab140c019f69369e51ef8389fd04e63e9f
MD5 hash: 15b50e6db59add01cb517a03f838797e
humanhash: music-jersey-florida-arizona
File name:SecuriteInfo.com.Win32.PWSX-gen.15282.3021
Download: download sample
Signature Loki
Create hunting rule
File size:589'312 bytes
First seen:2023-05-18 04:26:51 UTC
Last seen:2023-05-25 08:36:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:POvmgjumHMIDFgWgvu0cd6bbMKaMJ4V2SQ39s:P14r9yDvLAC
Threatray 4'173 similar samples on MalwareBazaar
TLSH T1BFC4E02127D9CB0BD16A427981E1C3F067769D84B8A6C7834FD9BC8FB1CB7E61321256
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon f8eae6e6e6e6e46a (13 x AgentTesla, 10 x Loki, 7 x Formbook)
Reporter SecuriteInfoCom
Tags:exe Loki

Intelligence

File Origin
# of uploads :
6
# of downloads :
504
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.15282.3021
Verdict:
Malicious activity
Analysis date:
2023-05-18 04:28:17 UTC
Tags:
trojan lokibot
Link:
https://app.any.run/tasks/29e0bb78-e118-41f6-a1fb-a2df915ecb99

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/390822/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.15282.3021.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo formbook packed remcos
Link:
https://www.filescan.io/uploads/6465a9162fe8bc4707a9f924/reports/cf465837-25d1-43ec-bcb3-d40ed7768492/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/b3303273446384f72e2a0f90c455f69598f341164c2bcfded2cf95b30e3a9295
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/156632f2-77b1-4985-8885-e1c6161478a7
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1235717
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3303273446384f72e2a0f90c455f69598f341164c2bcfded2cf95b30e3a9295/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-18 02:32:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wmyde42emocpolrkb6imivpwswmpgqiwjqv47xwsz6k3gdr2skkq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
04322d8af3fe7d7ba8c91fd9c076c7b7a71f216859cf6a33cbfda968cfaf6581
Loki
13b7f376d27ce6de51165613f7faf54350e0fbd2c50b509df1bdc3704e26808f
Loki
5c8cebda365a042d04dc1734322b809fdb56e95f0a7ce0b7bd3e141ebccc07bf
Loki
78a5a0b0bed684217ba65ee4f92daebaa0ef82c9f95d9a5999e0b3755e2ba823
Loki
7e44c6fb6963620960fe0f8574af42ec032aaff7238bf470cba2c4af3a9da77d
Loki
aa5db1e76d992d81c9b6f368bc705f4240512bc4aa193cc23fa3ba50ce48d1fc
Loki
c4359763aa0cac9b3d55b130cca1f38e1a4b3a2b80c55feff4e048b86d2e9c0f
Loki
e2de9b40fe4d786cefc62428bb7e17d2268f5bf6c8c939e576d86be69c90af90
Loki
e3bd0660f61bc671f91a00cac1734dd1854d7c7a2ae4293ddc960d274fdfbe6e
Loki
+ 4'163 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/230518-e23s5agg4v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://171.22.30.147/zino/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
23fd89364bc5d4ff6736c71e7773ec54ee15020d4b3241995d3395c7ec24d589
MD5 hash:
3c27d545fbd9e008d217f2dd8155e03c
SHA1 hash:
d5a0d33df26e27bcb2409e16f809793b77ae92fd
Link:
https://www.unpac.me/results/d1248ffc-d112-4a83-badb-1c335e66ff50/
SH256 hash:
2907ceb0aff33154a49177d6e04e822538f3fb439a55264cdf84b162564afea6
MD5 hash:
ae06e9b9c5d6df3bdb39fbbc75d9b9cd
SHA1 hash:
b03aff7dda4462819b1250e44d80c83aca37237f
Link:
https://www.unpac.me/results/d1248ffc-d112-4a83-badb-1c335e66ff50/
SH256 hash:
0544355e0cdf6d30059ebb363948f1f8e66c42c339c855377c7331b97d4335d5
MD5 hash:
7a5cce71c313516db664e78b32e8cd16
SHA1 hash:
9b8f1633260918e6edfd48bc85c696b13184ccd9
Link:
https://www.unpac.me/results/d1248ffc-d112-4a83-badb-1c335e66ff50/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/d1248ffc-d112-4a83-badb-1c335e66ff50/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
cae27450b662b12e2adbca87eb6ad54612f22cfd7d9cf2ab37d794f31521827a
MD5 hash:
ba285a91ab9c653a9ee757af95376297
SHA1 hash:
59e7df753854175fbf667c2f4f20f3f10ce8589a
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
Link:
https://www.unpac.me/results/d1248ffc-d112-4a83-badb-1c335e66ff50/
Parent samples :
9cedcc423c89f58cdef6386a96d9d57237cc0ce9b84622651691ec7e40d1e128
8394c05abbdce32e1b10f47a6d73dfa8faaa3b35da3ead54c9182216dfe795a8
aeb27e1efaca54eeb061a1d72e2df1513bf849e34b777c32d5b5201845f5de15
b3303273446384f72e2a0f90c455f69598f341164c2bcfded2cf95b30e3a9295
94a92d06d9fac7101cb5c15f1afe2bce92b2186085cadc1ea2c72b2f6e154912
10018c42effd32f85253fccf9e6de9e7afc97a7a9369af5ebc6bee351fb52e20
SH256 hash:
b3303273446384f72e2a0f90c455f69598f341164c2bcfded2cf95b30e3a9295
MD5 hash:
15b50e6db59add01cb517a03f838797e
SHA1 hash:
37c13fab140c019f69369e51ef8389fd04e63e9f
Link:
https://www.unpac.me/results/d1248ffc-d112-4a83-badb-1c335e66ff50/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b33032734463/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/b3303273446384f72e2a0f90c455f69598f341164c2bcfded2cf95b30e3a9295

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/390822/

Comments