MalwareBazaar Database

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

OLE dump

MalwareBazaar was able to identify 12 sections in this file using oledump:

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Intelligence

File Origin

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN lokibot

Malware family:

lokibot

Alert

Create hunting rule

ID:

1

File name:

Pago.doc

Verdict:

Malicious activity

Analysis date:

2024-12-04 16:22:36 UTC

Tags:

macros macros-on-open phishing lokibot stealer

Link:

https://app.any.run/tasks/997d66b7-9190-4f3e-aa3f-2132847ad2d6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

MiscreantPunch.EvilMacro.AODBWSRBMS.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.StatusIsLikeAFriend.20210201.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Macro-1.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Badmacro.XlsM.objshell.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67508274bc8c6beb3075abaf

Tags:

office macro micro

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Using the Windows Management Instrumentation requests

Creating a file

Сreating synchronization primitives

Reading critical registry keys

Changing a file

Connection attempt to an infection source

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Enabling the 'hidden' option for recently created files

Query of malicious DNS domain

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Stealing user critical data

Creating a process from a recently created file

Sending an HTTP POST request to an infection source

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

Legacy Word File with Macro

Link:

https://app.docguard.net/c14a6e9a7632cd3936d74adeb656b0d3147ec5233cc01c59a1e4bbd0e4d49b41/results/dashboard

Behaviour

BlacklistAPI detected

Document image

Image:

Download PNG

Hybrid Analysis Msoffice/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Msoffice/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/c14a6e9a7632cd3936d74adeb656b0d3147ec5233cc01c59a1e4bbd0e4d49b41

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

9.6/10

Score Malicious:

96%

Score Benign:

4%

Link:

https://www.malware.ai/gui/files/?id=558739d1-5e3a-4776-8060-32881b849f74

Joe Sandbox Lokibot

Result

Threat name:

Lokibot

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1568502

Signature

.NET source code contains process injector

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with hexadecimal encoded strings

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Document exploit detected (process start blacklist hit)

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Office process drops PE file

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

OFFICE

Link:

https://malprob.io/report/c14a6e9a7632cd3936d74adeb656b0d3147ec5233cc01c59a1e4bbd0e4d49b41

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c14a6e9a7632cd3936d74adeb656b0d3147ec5233cc01c59a1e4bbd0e4d49b41/

ReversingLabs TitaniumCloud Win32.Infostealer.LokiBot

Threat name:

Win32.Infostealer.LokiBot

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-12-04 16:21:04 UTC

File Type:

Document

Extracted files:

19

AV detection:

17 of 38 (44.74%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yffg5gtwglgtsnwxjlplmvvq2mkh5rjdhtabywnb4s55bzgutnaq._file

Threatray lokipasswordstealer(pws)

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Alert

Create hunting rule

Similar samples:

04f557582bc8b4c4af843d0c837124da73f887ac5b997efdd78f96d45caced85

Loki

0af4bdeb4de3a9f8cac5601c872cd4d9a7e9fb06a4fc0a7ed4fb60d6cb64b957

Loki

0dc69e491c783527c6465e25b8b33447391ae9d7ace6e4c1c20db8047aa1918a

Loki

0f6a0c8f4c9d3fa419bd22b2687328e7a721ad0b1ef504a64166b1c630997cee

Loki

16510508a55e331de91a5e246b4d0174a419203d557d7407861bf24a947ce16c

Loki

594a574211cffc47d78817221315092ab978403b71e1ff43922286ec9f60e188

Loki

79866667d5cd578a1c6eda54a748ff9d316fff39064eecd282bc2a9ad8a5ac7d

Loki

7f0fcb4f3651ec6a3b273322857afe8aa8373f77964afd0bb592378a4a97fe1a

Loki

a1f8dd874a1d63dfbd2cc504fbe6d5784eb00610b02fef44b606b7a127f41bc4

Loki

error

Loki

f3797cb6054ef9d5de1b4ecb2745424ef0481c5cb28ec2f2384d2591019e1650

Loki

+ 4'176 additional samples on MalwareBazaar

Hatching Triage lokibot

Result

Malware family:

lokibot

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lokibot collection discovery macro macro_on_action spyware stealer trojan

Link:

https://tria.ge/reports/241204-ttmt9s1kdz/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Office loads VBA resources, possible macro or embedded object present

System Location Discovery: System Language Discovery

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Lokibot

Lokibot family

Malware Config

C2 Extraction:

https://stipamana.com/redrshyjdft/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/e0c1f0e6-28fa-440a-8c18-3d45d0c0a9e9

VMRay Lokibot

Malware family:

Lokibot

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c14a6e9a7632/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Lokibot

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/c14a6e9a7632cd3936d74adeb656b0d3147ec5233cc01c59a1e4bbd0e4d49b41

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments