MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6522f4aa1002a1c75f0c2b16b53f6e948adee0a7fdd05eded6bed2d55235ad2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6522f4aa1002a1c75f0c2b16b53f6e948adee0a7fdd05eded6bed2d55235ad2
SHA3-384 hash: 307aa3894329e4c4042778f041a88a05ef289d8777f906c8e01f886cc447572e2d615f2e761252983b572f91c6045d36
SHA1 hash: 095eb6c85d2618950e38571f3c1cfba4952783e7
MD5 hash: 4cb0f0394cd2fa1a0b4d65b49de36b63
humanhash: black-speaker-football-red
File name:Shipment Document BL,INV and packing list.jpg.ace
Download: download sample
Signature Loki
Create hunting rule
File size:500'821 bytes
First seen:2023-07-19 09:10:19 UTC
Last seen:2023-07-19 11:58:54 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:2XjbqQKTqPDZqBBr8T9G4+bhB6OPbEP6BnmUeTKcA4q8O:2iQKTqbgfYpC9BvPSELcAF8O
TLSH T127B423977902148123A999E8F395AADD87E04E76D08023EB8F655D20F672FF135B0F4E
Reporter cocaman
Tags:ace DHL Loki


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL International GmbH<imp-exp@cerubo.com>" (likely spoofed)
Received: "from [45.81.39.32] (unknown [45.81.39.32]) "
Date: "19 Jul 2023 12:52:15 +0200"
Subject: "Shipment Document BL,INV and packing list"
Attachment: "Shipment Document BL,INV and packing list.jpg.ace"

Intelligence

File Origin
# of uploads :
3
# of downloads :
100
Origin country :
CH CH
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
context-ace masquerade packed
Link:
https://www.filescan.io/uploads/64b7a8a7feab465ae3506d99/reports/7e623e98-d732-471a-bb51-924052401f33/overview
Verdict:
Malicious
Labled as:
Mal/DrodAce
Link:
https://www.hybrid-analysis.com/sample/b6522f4aa1002a1c75f0c2b16b53f6e948adee0a7fdd05eded6bed2d55235ad2
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6522f4aa1002a1c75f0c2b16b53f6e948adee0a7fdd05eded6bed2d55235ad2/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2023-07-18 12:27:27 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wzjc6svbaavby5pqykywwu7w5fek33qkp7oql3pnnpws2vjdllja._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/230719-k964eaaf66/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://138.68.56.139/?p=13459621
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b6522f4aa1002a1c75f0c2b16b53f6e948adee0a7fdd05eded6bed2d55235ad2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ACE_Containing_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems) - based on Nick Hoffman' rule - Morphick Inc
Description:Looks for ACE Archives containing an exe/scr file

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

ace b6522f4aa1002a1c75f0c2b16b53f6e948adee0a7fdd05eded6bed2d55235ad2

(this sample)

Loki

Executable exe 2e0d0762433ff21184bb4e8330db8fa104958537fad81fb39d8e3e7d849ee9f8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2e0d0762433ff21184bb4e8330db8fa104958537fad81fb39d8e3e7d849ee9f8
  
Dropping
Loki
  
Dropping
MD5 5e4d39e60ff35813b11c0f7875c87d38

Comments