MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c03b5d783971f4ab3ae3dac1b9576acfc0334cd919ffd74bb6ac01cbef2b128d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 8

Intelligence 8 IOCs 1 YARA File information Comments

SHA256 hash:	c03b5d783971f4ab3ae3dac1b9576acfc0334cd919ffd74bb6ac01cbef2b128d
SHA3-384 hash:	d2b113f4eb8d01bc9debc600d676eaa5a16a9728134f26f16b2a3f1e94d92bf5ff62c2a3d95171083ae64195f20789ec
SHA1 hash:	5453c2cf3ef88a19247ceef6e2eed3abbe8bc004
MD5 hash:	af95cba60a0fd16678f0df73d9dcc1b7
humanhash:	sixteen-michigan-burger-minnesota
File name:	Shipment Document BL,INV and packing list.jpg.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	189'616 bytes
First seen:	2021-06-22 07:31:02 UTC
Last seen:	2021-06-22 08:49:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	269fbb82c8f402e670c866cdbdfbba84 (4 x GuLoader, 2 x Loki, 1 x BitRAT)
ssdeep	3072:RTk3TZNosPnTfZlkqBkSMGaysAVzdYTGgy1RnkCK83+TtjL:tWfomn36SMGaysAVzdYTzy1l9MV
Threatray	5'126 similar samples on MalwareBazaar
TLSH	97046CA37680F833DB6D95716B1189FD2C989C701D69C9C3D2C03B5FDAB96E0C225A27
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Loki C2:
http://bursawebsayfa.com/hunnn/lokinew/fre.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://bursawebsayfa.com/hunnn/lokinew/fre.php	https://threatfox.abuse.ch/ioc/139820/

Intelligence

File Origin

# of uploads :

# of downloads :

122

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Shipment Document BL,INV and packing list.jpg.exe

Verdict:

Malicious activity

Analysis date:

2021-06-22 07:32:30 UTC

Tags:

trojan lokibot stealer opendir

Link:

https://app.any.run/tasks/ebf67d2c-09d6-4084-b3b2-0ff6e4493f7e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/167482/

Detection(s):

SecuriteInfo.com.Trojan.PackedENT.228.6071.5851.UNOFFICIAL

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a913dd7e-c3f7-48c8-b626-ccfa064eba71

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/805798

Signature

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Executable has a suspicious name (potential lure to open the executable)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

guloader

Link:

https://mwdb.cert.pl/sample/c03b5d783971f4ab3ae3dac1b9576acfc0334cd919ffd74bb6ac01cbef2b128d/

Threat name:

Win32.Backdoor.Androm

Status:

Malicious

First seen:

2021-06-22 01:11:59 UTC

AV detection:

7 of 46 (15.22%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ya5v26bzoh2kwoxd3la3sv3kz7adgtgzdh75os5wvqa4x3zlckgq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:guloader family:lokibot downloader spyware stealer trojan

Link:

https://tria.ge/reports/210622-r5qv3xy4ts/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Checks QEMU agent file

Guloader,Cloudeye

Lokibot

Malware Config

C2 Extraction:

https://onedrive.live.com/download?cid=1130B101447311D6&resid=1130B101447311D6%21109&authkey=AHRHkJGxHBE1rNw
https://bursawebsayfa.com/hunnn/lokinew/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

49b04162c412105ab0857de16713724cbf3234a0b6ba51f3a5286312633f20c3

MD5 hash:

1f1b425190b2fb0396ad2d538b1060ba

SHA1 hash:

413f98641d46fdcabfcaf64f29495667de6282ea

Link:

https://www.unpac.me/results/28697c92-9173-4693-adcd-25df3424200c/

SH256 hash:

c03b5d783971f4ab3ae3dac1b9576acfc0334cd919ffd74bb6ac01cbef2b128d

MD5 hash:

af95cba60a0fd16678f0df73d9dcc1b7

SHA1 hash:

5453c2cf3ef88a19247ceef6e2eed3abbe8bc004

Link:

https://www.unpac.me/results/28697c92-9173-4693-adcd-25df3424200c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c03b5d783971f4ab3ae3dac1b9576acfc0334cd919ffd74bb6ac01cbef2b128d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/167482/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample