MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bebaf132c73e03c11cd32a3551abf02369edd8ee465e36701331502717340a66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	bebaf132c73e03c11cd32a3551abf02369edd8ee465e36701331502717340a66
SHA3-384 hash:	881feb85fb6a59b693c7ddcfadede94b38dfee9d530c84aa17c74135cfa0daa49bc4409344986d1fb6451250fc8b54b5
SHA1 hash:	5c631a5ce02ea6d36c9beb910d3b0352a77900e9
MD5 hash:	d009073229a4241314aee30ec3a65001
humanhash:	yankee-wolfram-vermont-bravo
File name:	C.O.A of Materials Placebo.PDF.gz
Download:	download sample
Signature	Loki Create hunting rule
File size:	625'332 bytes
First seen:	2021-04-22 05:38:31 UTC
Last seen:	Never
File type:	gz
MIME type:	application/gzip
ssdeep	12288:5A50NzPrjN8y0iyiSpKN/QZtZuiMDrFb4XY0bUfLDDfIDqhh8Y7LY+vNiVcZc:O5CPrjNQiVSIlm2DBb90QDSqhHLdlIac
TLSH	E2D433BF70B1E598D32E48D53CCB47584073E13E2B5E584AE219A889C2A13C4DE6F1ED
Reporter	cocaman
Tags:	gz Loki

cocaman

Malicious email (T1566.001)
From: "Lucio USVARDI Area Manager <gogon@designpartnersindonesia.com>" (likely spoofed)
Received: "from mail.designpartnersindonesia.com (mail.designpartnersindonesia.com [45.126.132.42]) "
Date: "Wed, 21 Apr 2021 12:31:51 -0700"
Subject: "RE:Fw: C.O.A of Materials Placebo"
Attachment: "C.O.A of Materials Placebo.PDF.gz"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Variant.Strictor.256678.31544.14826.UNOFFICIAL

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bebaf132c73e03c11cd32a3551abf02369edd8ee465e36701331502717340a66/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-04-21 15:54:40 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

15 of 29 (51.72%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=x25pcmwhhyb4chgtfi2vdk7qenu63whoizpdm4atgficofzubjta._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/210422-1bbctrka3x/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Lokibot

Malware Config

C2 Extraction:

http://51.195.53.221/p.php/8eFELX93dnLC9
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AgentTesla

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bebaf132c73e03c11cd32a3551abf02369edd8ee465e36701331502717340a66