MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc25deacda2e313aef6e1bc19940cbafdc8e881dd00f5b7f9dd1b57c27fd3795. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 14


Intelligence 14 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bc25deacda2e313aef6e1bc19940cbafdc8e881dd00f5b7f9dd1b57c27fd3795
SHA3-384 hash: a9f0e702c81c120b7249efcb02f65ff86ebbc59f12c67ccf6d0a1d4476326e0363008aed14859f310c6c04f2e9e0362a
SHA1 hash: 18fd9c912365e52bb743227e37c9da8674da4a65
MD5 hash: aa642ebb7ebd9e3f1cfae4c657ccd6e2
humanhash: berlin-undress-eighteen-yellow
File name:gunzipped.exe
Download: download sample
Signature Loki
Create hunting rule
File size:331'768 bytes
First seen:2022-08-05 20:25:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (720 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 6144:ONeZc5FBkXpIwbmr2KOih4SXSuVz2Q0ijKkAcWyKg:ONRTr2KOiOSF/0ijScWrg
TLSH T1B46419C1E599FCD5C428007659B9E521250BAB6EF0B8493B396A7519B0FF383607BE0F
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon d4d0d4ccccdcec34 (4 x Loki, 1 x GuLoader)
Reporter abuse_ch
Tags:exe Loki signed

Code Signing Certificate

Organisation:Pungabe Systemudviklingssystems
Issuer:Pungabe Systemudviklingssystems
Algorithm:sha256WithRSAEncryption
Valid from:2021-12-22T11:45:21Z
Valid to:2024-12-21T11:45:21Z
Serial number: -5a8e1fb75570285f
Thumbprint Algorithm:SHA256
Thumbprint: 2d1bab036e06a68fbef11872300ec679edc59fe2e8bea8fb7435900803c9438a
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
Loki C2:
http://66.29.145.162/?java

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://66.29.145.162/?java https://threatfox.abuse.ch/ioc/841549/

Intelligence

File Origin
# of uploads :
1
# of downloads :
438
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
gunzipped.exe
Verdict:
Malicious activity
Analysis date:
2022-08-05 20:28:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/22d60959-e9df-4c2c-8e60-cec9ae58ce2b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/296771/
Detection(s):
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.6896.UNOFFICIAL
Create hunting rule

Win.Dropper.LokiBot-9960537-0
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Delayed reading of the file
Creating a file in the %temp% subdirectories
Searching for the window
Searching for the Windows task manager window
Running batch commands
Creating a process with a hidden window
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/28188/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
guloader lokibot nemesis overlay packed shell32.dll wacatac
Link:
https://www.filescan.io/uploads/62ed7d55bcf76fcb6ce95ebe/reports/ce60c4e2-a554-4fb4-a5bf-244bba827956/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/efdfeb00-7ace-476d-afef-f2ef21791bb6
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1047018
Signature
C2 URLs / IPs found in malware configuration
Mass process execution to delay analysis
Multi AV Scanner detection for submitted file
Obfuscated command line found
Snort IDS alert for network traffic
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 679508 Sample: gunzipped.exe Startdate: 05/08/2022 Architecture: WINDOWS Score: 100 49 googlehosted.l.googleusercontent.com 2->49 51 drive.google.com 2->51 53 doc-0k-70-docs.googleusercontent.com 2->53 61 Snort IDS alert for network traffic 2->61 63 Multi AV Scanner detection for submitted file 2->63 65 Yara detected GuLoader 2->65 67 2 other signatures 2->67 9 gunzipped.exe 35 2->9         started        signatures3 process4 file5 45 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 9->45 dropped 47 C:\Users\user\AppData\Local\...\System.dll, PE32 9->47 dropped 69 Obfuscated command line found 9->69 71 Mass process execution to delay analysis 9->71 73 Tries to detect Any.run 9->73 13 gunzipped.exe 21 9->13         started        17 cmd.eXe 9->17         started        19 cmd.eXe 9->19         started        21 62 other processes 9->21 signatures6 process7 dnsIp8 55 66.29.145.162, 49802, 80 ADVANTAGECOMUS United States 13->55 57 googlehosted.l.googleusercontent.com 172.217.16.129, 443, 49801 GOOGLEUS United States 13->57 59 drive.google.com 216.58.208.110, 443, 49799 GOOGLEUS United States 13->59 75 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->75 77 Tries to steal Mail credentials (via file / registry access) 13->77 79 Tries to harvest and steal ftp login credentials 13->79 81 2 other signatures 13->81 23 WerFault.exe 2 13->23         started        25 Conhost.exe 17->25         started        27 Conhost.exe 17->27         started        29 Conhost.exe 17->29         started        31 Conhost.exe 19->31         started        33 Conhost.exe 21->33         started        35 Conhost.exe 21->35         started        37 Conhost.exe 21->37         started        39 55 other processes 21->39 signatures9 process10 process11 41 Conhost.exe 25->41         started        43 Conhost.exe 31->43         started       
Detection:
guloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bc25deacda2e313aef6e1bc19940cbafdc8e881dd00f5b7f9dd1b57c27fd3795/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2022-08-05 10:53:17 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xqs55lg2fyytv33odpazsqglv7oi5ca52ahvw7452g2xyj75g6kq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:lokibot collection downloader spyware stealer trojan
Link:
https://tria.ge/reports/220805-y7txysghg6/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Legitimate hosting services abused for malware hosting/C2
Checks QEMU agent file
Loads dropped DLL
Reads user/profile data of web browsers
Guloader,Cloudeye
Lokibot
Unpacked files
SH256 hash:
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 hash:
cff85c549d536f651d4fb8387f1976f2
SHA1 hash:
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
Link:
https://www.unpac.me/results/bf9c5bad-7d12-4f57-bb99-54cf0ca517fe/
SH256 hash:
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
MD5 hash:
675c4948e1efc929edcabfe67148eddd
SHA1 hash:
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
Link:
https://www.unpac.me/results/bf9c5bad-7d12-4f57-bb99-54cf0ca517fe/
SH256 hash:
0b2277d8aaf36e01aca3ae33e227b44bebc541a9c5cef6eb4fef93e96821a6cd
MD5 hash:
b1ba7a8263281244782ca5604876cb2c
SHA1 hash:
b8523dee6d7e74512a05c60cc35c0fddac370252
Link:
https://www.unpac.me/results/bf9c5bad-7d12-4f57-bb99-54cf0ca517fe/
SH256 hash:
bc25deacda2e313aef6e1bc19940cbafdc8e881dd00f5b7f9dd1b57c27fd3795
MD5 hash:
aa642ebb7ebd9e3f1cfae4c657ccd6e2
SHA1 hash:
18fd9c912365e52bb743227e37c9da8674da4a65
Link:
https://www.unpac.me/results/bf9c5bad-7d12-4f57-bb99-54cf0ca517fe/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bc25deacda2e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.98
Link:
https://yomi.yoroi.company/submissions/bc25deacda2e313aef6e1bc19940cbafdc8e881dd00f5b7f9dd1b57c27fd3795

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/296771/

Comments