MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b453e21bb868ec936faa3e048a7f0b4dd17456dd6ede5672b99ae0541f675020. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b453e21bb868ec936faa3e048a7f0b4dd17456dd6ede5672b99ae0541f675020
SHA3-384 hash: e636134f44eb9039f0db272f7eb1877f0292876324be58611115b3e4886e28187f3e6f8c41d9e7fcfa5dfe0251bed585
SHA1 hash: b669b5efb95fe10559eccdf769142f22e428648c
MD5 hash: 1324849943c4f9006f520c814ede75e7
humanhash: pluto-four-robert-november
File name:Urgent RFQ.exe
Download: download sample
Signature Loki
Create hunting rule
File size:1'184'256 bytes
First seen:2020-05-12 13:58:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:Rtb20pkaCqT5TBWgNQ7agvmD5uMEtE6A:iVg5tQ7agvmDMK5
Threatray 2'339 similar samples on MalwareBazaar
TLSH 2B457C12239BC260CE6E51736A1573016E6BE8153760FCF72FB4893DA8201E15E7A76F
Reporter jarumlus
Tags:Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 14:40:44 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wrj6eg5yndwjg35khyciu7yljxixivw5n3pfm4vztlqfih3hkaqa._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
0adecb6f10ce532902f8c9fcd67682beb29f07cb3a6c791443cbb4991ded905b
Loki
0ce415968da95cacf9c2e3f008d29462100fe51eef1d9201ce32632f5ec14d77
Loki
2a3c60d816836bf1cecb31f34d4eaf5b93976c123364538d5b8e22e9272e1269
Loki
6091c72afc1b64e11cca31aa5375871a3e3b99e769e20bc95abe7fc4a6626f7e
Loki
71f0b9fb2f57cc170b742c61535c5c657609766c18b00ef1e08cf737954a7433
Loki
79129af7eeae9ebb06e1e77ceb732e24565771282c1381b15a3f19721936b84c
Loki
a4c9485c1fc597e651e339316265c457865812f656b5cbc3595bdf54f8eb6623
Loki
acd12da4b4032af20f766c6a2e26b837bcfd543fd01031fb0a9e4812ef66d103
Loki
e0e899627677a5191b45c3da7da2f9c83e5840e45b70142816ccc7c18d5b4ada
Loki
f32d1725c917672afcea8f55889bd90ad5199f7d40b7656dba7e365f7df4b79c
Loki
+ 2'329 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/201109-gdttv14nhx/
Behaviour
Delays execution with timeout.exe
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Deletes itself
Lokibot
Malware Config
C2 Extraction:
http://scarfponcho.com/notsite/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

ecc73954f31a166647812350b329dcf0392eb2a85bf3c9241a5856a5ddb8f64f

Loki

Executable exe b453e21bb868ec936faa3e048a7f0b4dd17456dd6ede5672b99ae0541f675020

(this sample)

  
Dropped by
MD5 8131533dd3464f8fec2719a9ae464a41
  
Dropped by
SHA256 ecc73954f31a166647812350b329dcf0392eb2a85bf3c9241a5856a5ddb8f64f
  
Delivery method
Distributed via e-mail attachment

Comments