MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b83f53f67a2b2fa4d2abf6a0ce7b75542685661deaac9aeb2159f5e25977e10e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 14

Intelligence 14 IOCs YARA File information Comments

SHA256 hash:	b83f53f67a2b2fa4d2abf6a0ce7b75542685661deaac9aeb2159f5e25977e10e
SHA3-384 hash:	d6561d3e9aacf6e7a8b1b0349bdf71282f4df283c0c42090d4597abd223e2ab8d5e178de8fdf29c464dea16d2d1cdf68
SHA1 hash:	f4076bac7244876f5e9d460cc9f5644f94dd3439
MD5 hash:	bb81a5ed59bce783033cbede91359eb9
humanhash:	wisconsin-robin-violet-pennsylvania
File name:	SecuriteInfo.com.W32.AIDetect.malware2.24790.9435
Download:	download sample
Signature	Loki Create hunting rule
File size:	347'648 bytes
First seen:	2021-10-11 11:22:36 UTC
Last seen:	2021-10-11 12:04:27 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	61b48ca689a3ea2404ab8a6768ce938b (6 x RedLineStealer, 3 x Smoke Loader, 1 x DanaBot)
ssdeep	6144:HLyZ0C6CbAPGBHf2k/QVIRo6naoPINpOpIkqrppsX2:re0CW+BpYORoQaoPWOpjqrz
Threatray	5'008 similar samples on MalwareBazaar
TLSH	T152747D00B7B0C035F3F316F949BA5AA9A53E79A16B6494CF22D15AEE46347D1EC30317
File icon (PE):
dhash icon	9824e7d0e4e72158 (3 x Smoke Loader, 2 x RedLineStealer, 1 x RaccoonStealer)
Reporter	SecuriteInfoCom
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

146

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Invoice- INV-121920.xlsx

Verdict:

Malicious activity

Analysis date:

2021-10-11 08:58:34 UTC

Tags:

encrypted opendir exploit CVE-2017-11882 loader trojan lokibot stealer

Link:

https://app.any.run/tasks/2b8a7c1b-671f-44cd-8451-bb345a48d152

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/196594/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.24790.9435.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Reading critical registry keys

Changing a file

Replacing files

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Stealing user critical data

Moving of the original file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware stop

Link:

https://www.filescan.io/uploads/61641e97fd35fe780c37dcf6/reports/554c2927-f1f2-4530-91bc-b8f9f1827b32/overview

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/867963

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/b83f53f67a2b2fa4d2abf6a0ce7b75542685661deaac9aeb2159f5e25977e10e/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-10-11 11:23:06 UTC

AV detection:

21 of 28 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xa7vh5t2fmx2juvl62qm463vkqtikzq55kwjv2zblh26ewlx4eha._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/211011-ng5awshab9/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

outlook_office_path

outlook_win_path

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://136.243.159.53/~element/page.php?id=119
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php