MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b494bc7c282b57a3d9dc02d6d3ad8430dc965465cb17fe43acde2874f7266465. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b494bc7c282b57a3d9dc02d6d3ad8430dc965465cb17fe43acde2874f7266465
SHA3-384 hash: 40364230afd621d5d21cd9932bd528569bae23a0c7f30dabf8894f9a3474dc50edfcadeec3582c9d55811674567fd5d0
SHA1 hash: d0aece6102615637ad4ae9670936135b8a43d205
MD5 hash: 8504c3db2dc94f6d691cd22c163345ac
humanhash: blossom-bulldog-bravo-zebra
File name:PO.exe
Download: download sample
Signature Loki
Create hunting rule
File size:346'112 bytes
First seen:2020-06-23 08:45:52 UTC
Last seen:2020-06-23 09:33:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 390e29859a8109da4988860f226bf922 (5 x AgentTesla, 4 x Loki, 1 x NanoCore)
ssdeep 6144:EujNTo2ybezRH7WdHitmi7zXkVKmzSeODgo0qrRQyF6kPpSX2US:ESToRClCCIiXXkVW7codrRVAkPMX1S
Threatray 1'573 similar samples on MalwareBazaar
TLSH AB7401E2DB049CF5C61D897309230E654729F422293F5FC32A94AE1DF139ACFAF4561A
Reporter jarumlus

Intelligence

File Origin
# of uploads :
2
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12929/
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b494bc7c282b57a3d9dc02d6d3ad8430dc965465cb17fe43acde2874f7266465/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-23 08:47:03 UTC
File Type:
PE (Exe)
Extracted files:
571
AV detection:
25 of 27 (92.59%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wskly7bifnl2hwo4allnhlmegdojmvdfzml74q5m3yuhj5zgmrsq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
093261263ec2d1ec3042f09400aa7aa6e2963fca22089bec1718bddd80225673
Loki
38605c9b483d95d6729af644ff2338d10d2b6714012c4299a083988e5739387b
Loki
3968f76530e5c9471adb0a30c06159c939f59538a27fb9e9c508857de42fc1b5
Loki
4311521a696874a86ea0e4dcecbbd6936ef077955bb85659ea1552515b6e6da0
Loki
771e24bf597185ef9c18a2b45b018773c4128f4a80fab40b5cd6d00bcce16f99
Loki
7fa734ae8d4dd945ab53df6bc39a42134e91411aa06ea0bdda0425e7c60911c6
Loki
8365241d902a7196708f6ba21b1438661ac1ea2618b8046bfe8a742e1403106b
Loki
9332d033a54d5c11bb1115012e5cd8e1a08efdf242784ccad6cbeded2f57e1d0
Loki
9ed49839f97c5bd2844562286ae50e5ccf1dcf6d0b47399d857f4fd8671c01db
Loki
e1303b3fa517337cb6c5724fb6c2dfb66cbe7a9ab93b0b7286a0972c51278bc5
Loki
+ 1'563 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
spyware trojan stealer family:lokibot
Link:
https://tria.ge/reports/200624-8a7g15xbtx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: RenamesItself
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://mecharnise.ir/ea1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

9a172a27f55aafd88996cb11839e238b91d55cc8f39e63c95b11c38478fdb878

Loki

Executable exe b494bc7c282b57a3d9dc02d6d3ad8430dc965465cb17fe43acde2874f7266465

(this sample)

  
Dropped by
MD5 8caff44ac14490bea83efce4625f6976
  
Dropped by
SHA256 9a172a27f55aafd88996cb11839e238b91d55cc8f39e63c95b11c38478fdb878
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/12929/

Comments