MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb84e516851ec948d169ef7b84cfaedbe4db5b8e8ddd16edfacd3c012a6165fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 10

Intelligence 10 IOCs 1 YARA File information Comments

SHA256 hash:	bb84e516851ec948d169ef7b84cfaedbe4db5b8e8ddd16edfacd3c012a6165fc
SHA3-384 hash:	4a40f2b451240eaa2008ddfe43a7ce9f8e5264e3d6754eb6bce872d1f17b973b8a71c4d0f21342ed7599ae2adf927738
SHA1 hash:	de90a89c267a64f2ace75cd9f27d9bbbc7dbbd80
MD5 hash:	55b4460e9dc7cd58d74976df231389de
humanhash:	summer-batman-failed-table
File name:	Pedido de cotacao 11-08-2021·pdf.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	155'648 bytes
First seen:	2021-08-11 11:00:53 UTC
Last seen:	2021-08-11 11:55:57 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3d408f10776c7bc07e6509fa832af9ca (3 x Loki)
ssdeep	1536:3kOzGXoo9jfz6+QixT9kPVtBR7txlr1ENsV9DqJV:0PrjrOeZYBBrMO5U
Threatray	7'577 similar samples on MalwareBazaar
TLSH	T192E3517777C2EA2DD059C5B4367AC1AAAC12B47727524E037186DB0A80F43BB6CF9E05
dhash icon	c8eaeac440d4aaea (3 x Loki)
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Loki C2:
http://185.227.139.5/sxisodifntose.php/6We0YzNidcg3L

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://185.227.139.5/sxisodifntose.php/6We0YzNidcg3L	https://threatfox.abuse.ch/ioc/171861/

Intelligence

File Origin

# of uploads :

# of downloads :

123

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Pedido de cotacao 11-08-2021·pdf.exe

Verdict:

No threats detected

Analysis date:

2021-08-11 11:02:59 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/dfc8f33c-95fb-4a37-be53-029da8f7a3d5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Variant.Jaik.47295.12476.5983.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a process from a recently created file

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4d388b6c-6185-4a29-bbbe-63a90fb7892b

Result

Threat name:

GuLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/830836

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

GuLoader behavior detected

Hides threads from debuggers

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bb84e516851ec948d169ef7b84cfaedbe4db5b8e8ddd16edfacd3c012a6165fc/

Threat name:

Win32.Backdoor.Androm

Status:

Malicious

First seen:

2021-08-11 11:01:09 UTC

AV detection:

10 of 46 (21.74%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xocokfufd3eurulj555yjt5o3psnww4orxorn3p2zu6acktbmx6a._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:guloader family:lokibot downloader spyware stealer suricata trojan

Link:

https://tria.ge/reports/210811-j9mv1s3ewe/

Behaviour

Modifies system certificate store

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Checks QEMU agent file

Guloader,Cloudeye

Lokibot

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://185.227.139.5/sxisodifntose.php/6We0YzNidcg3L
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

49b04162c412105ab0857de16713724cbf3234a0b6ba51f3a5286312633f20c3

MD5 hash:

1f1b425190b2fb0396ad2d538b1060ba

SHA1 hash:

413f98641d46fdcabfcaf64f29495667de6282ea

Link:

https://www.unpac.me/results/74099444-2afe-49f5-ae7a-efb3ce66c481/

SH256 hash:

bb84e516851ec948d169ef7b84cfaedbe4db5b8e8ddd16edfacd3c012a6165fc

MD5 hash:

55b4460e9dc7cd58d74976df231389de

SHA1 hash:

de90a89c267a64f2ace75cd9f27d9bbbc7dbbd80

Link:

https://www.unpac.me/results/74099444-2afe-49f5-ae7a-efb3ce66c481/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/bb84e516851e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/bb84e516851ec948d169ef7b84cfaedbe4db5b8e8ddd16edfacd3c012a6165fc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample