MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b59374ff4efaa214c04a353aa3cf500ca22c43b63f27d0c3fb0495bd942ac734. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 8

Intelligence 8 IOCs 1 YARA File information Comments

SHA256 hash:	b59374ff4efaa214c04a353aa3cf500ca22c43b63f27d0c3fb0495bd942ac734
SHA3-384 hash:	be3768467e097e4be7b26398a64a9537a3b2a861fa0b09c715f82137bc8af33949f04b25b89ce423b927c638c28d06b2
SHA1 hash:	dc62890154b6fd1ff903f8c71578b8384752ed40
MD5 hash:	3b07dcdb8837fe250ab527c850101859
humanhash:	pip-quebec-kentucky-nevada
File name:	Request For Price quotation 17-06-2021PDF.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	159'744 bytes
First seen:	2021-06-17 03:26:38 UTC
Last seen:	2021-06-18 15:38:50 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	646b0badad20ba025cd8fef6f59a6973 (3 x Loki)
ssdeep	768:q9kagJWWhfVM97twgLnSY6kzVbZEr0vUT2LMRgZ518Om60cdJgInbO7TeFBpwdJm:8CwtznSY6KvhZce0cTgIbqP2udE
Threatray	4'974 similar samples on MalwareBazaar
TLSH	F7F36C67E958CA26F206C730E4A5C0FC2647BC719953CF137561076FBCB26C2A9A122F
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Loki C2:
http://63.141.228.141/32.php/xQQt9MzAG0t6V

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://63.141.228.141/32.php/xQQt9MzAG0t6V	https://threatfox.abuse.ch/ioc/131520/

Intelligence

File Origin

# of uploads :

# of downloads :

160

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Request For Price quotation 17-06-2021PDF.exe

Verdict:

Malicious activity

Analysis date:

2021-06-17 03:27:28 UTC

Tags:

trojan lokibot stealer

Link:

https://app.any.run/tasks/275b42e4-3a97-423f-86e8-95f609dd7ca5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Variant.Graftor.964614.12111.6897.UNOFFICIAL

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a208030f-9582-448d-a47b-cc916c142f8f

Result

Threat name:

GuLoader

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/803447

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found malware configuration

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Potential malicious icon found

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

guloader

Link:

https://mwdb.cert.pl/sample/b59374ff4efaa214c04a353aa3cf500ca22c43b63f27d0c3fb0495bd942ac734/

Threat name:

Win32.Trojan.Graftor

Status:

Malicious

First seen:

2021-06-17 03:27:08 UTC

AV detection:

18 of 46 (39.13%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=wwjxj72o7krbjqckgu5kht2qbsrcyq5wh4t5bq73ask33fbky42a._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:guloader family:lokibot downloader spyware stealer trojan

Link:

https://tria.ge/reports/210617-jet1af4x7j/

Behaviour

Modifies system certificate store

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Checks QEMU agent file

Guloader,Cloudeye

Lokibot

Malware Config

C2 Extraction:

https://drive.google.com/uc?export=download&id=13xANdAkOVEJ7UGc85FWz7yJc_1Ot-aih
http://63.141.228.141/32.php/xQQt9MzAG0t6V
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

49b04162c412105ab0857de16713724cbf3234a0b6ba51f3a5286312633f20c3

MD5 hash:

1f1b425190b2fb0396ad2d538b1060ba

SHA1 hash:

413f98641d46fdcabfcaf64f29495667de6282ea

Link:

https://www.unpac.me/results/99114d56-9f7e-4061-a075-c4bd7fd3fbd5/

SH256 hash:

b59374ff4efaa214c04a353aa3cf500ca22c43b63f27d0c3fb0495bd942ac734

MD5 hash:

3b07dcdb8837fe250ab527c850101859

SHA1 hash:

dc62890154b6fd1ff903f8c71578b8384752ed40

Link:

https://www.unpac.me/results/99114d56-9f7e-4061-a075-c4bd7fd3fbd5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b59374ff4efaa214c04a353aa3cf500ca22c43b63f27d0c3fb0495bd942ac734

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample