MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4ed389d2a13951afac8a80ed50b7e23fd90f99ae590360a6b7387aff965f104. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 16

Intelligence 16 IOCs YARA 13 File information Comments

SHA256 hash:	c4ed389d2a13951afac8a80ed50b7e23fd90f99ae590360a6b7387aff965f104
SHA3-384 hash:	4cb3fd4191a01a058f68dccf5452f10cf30f626a4b43530048e461ea18766d635d8b5aed2225d35833db06beacbca590
SHA1 hash:	7845003b12c664c29944615af5ca207f4eea2469
MD5 hash:	4aa7a7f30717b0ae10fbf9b943e91480
humanhash:	edward-blossom-five-happy
File name:	4aa7a7f30717b0ae10fbf9b943e91480.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	660'480 bytes
First seen:	2022-08-25 11:19:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'207 x SnakeKeylogger)
ssdeep	12288:AAGnhyQfKT/0e5hz9bnTG1O6AJN4kxqDf2ml/estPx:cnh3fKT/0shbEO6AJhulGstP
Threatray	9'295 similar samples on MalwareBazaar
TLSH	T133E4CF1027EC4B08F7BB5B39EA7181254BF9BC8A6538E20E3DD0B4DD5974F029B11B66
TrID	72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.4% (.EXE) Win64 Executable (generic) (10523/12/4) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	00c4e0e8e8e8f0f0 (5 x NanoCore, 5 x AgentTesla, 5 x Formbook)
Reporter	abuse_ch
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

409

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

lokibot

ID:

File name:

BL No. FDIRINDMUN002123.xlsx

Verdict:

Malicious activity

Analysis date:

2022-08-25 06:48:29 UTC

Tags:

encrypted opendir exploit CVE-2017-11882 loader trojan lokibot stealer

Link:

https://app.any.run/tasks/2d7de6db-b1cb-4888-928a-dde410cfdf25

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/301155/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Stealer.23680.24662.4417.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Creating a file

Enabling the 'hidden' option for analyzed file

Moving of the original file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/63075b753cbb13868a7f3190/reports/01181c25-d895-4fac-9179-8de453571e78/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cf076f0b-30d4-4fe7-8286-b6c78a7be433

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1057662

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/c4ed389d2a13951afac8a80ed50b7e23fd90f99ae590360a6b7387aff965f104/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-08-25 04:55:54 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ytwtrhjkcokrv6wivahnkc36ep6zb6m24widmctlood276lf6eca._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Loki

52b18494008811d0277d2a3397df855d80a9575c09e11225950fd9f505850346

Loki

def88fc364ed03678d528bfd6bc39f19ff1831b098aaf0705fa13063c4044a2a

Loki

ec2a93f1858ba7e0de894944d57fb4b2f3021e5574d1b3594bfd8ffe32f7b029

Loki

f998a60cb95f390ca201950cf41b1764646f2f8ca91f13c05fbf78282518e741

Loki

fa4058c30f37d1cdb72e5bbcc467ff8f9b584b090bfdf723ac1f04817980096a

Loki

+ 9'285 additional samples on MalwareBazaar

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/220825-nff7nscbek/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://208.67.105.162/cloud2/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

ceda93fdfce3ad8e4f800d4f2d940d793b68b4b0b254b652bf42e13dbd189ba7

MD5 hash:

786afe844ec1723b635cace747b60efd

SHA1 hash:

fa647a584a7fcad392147a182e3a2435b3ad5bb9

Link:

https://www.unpac.me/results/89d61aae-7837-4542-857b-b3ec309ede1a/

SH256 hash:

8d55cb835be7d09e1ec7104809aadf70190c5c254ef166e666c3188c65b12e12

MD5 hash:

ba07073d8e877714dd272970be44c818

SHA1 hash:

aefc7cff266fd1243dfd13ac0df6f9c1f2e59e1f

Link:

https://www.unpac.me/results/89d61aae-7837-4542-857b-b3ec309ede1a/

SH256 hash:

1a70febe5b093e0718d15e8396ea13846d38f20e722556890f366ac569442d41

MD5 hash:

266615addc244e0b82a84c845ca235b0

SHA1 hash:

96e0e33819dfb03563336ed3e965f1aac8db1099

Link:

https://www.unpac.me/results/89d61aae-7837-4542-857b-b3ec309ede1a/

SH256 hash:

c9ccdfd868ee1c7a9054929665a8510d6ebd97640e2a1d083cf4cad125b422a5

MD5 hash:

5b98d6311865844f7a481d80328b9a4b

SHA1 hash:

3c2dd8c194790d31fe069c8903ef72fb9c5ff2f7

Detections:

win_lokipws_g0

win_lokipws_auto

lokibot

Link:

https://www.unpac.me/results/89d61aae-7837-4542-857b-b3ec309ede1a/

Parent samples :

dddb0db17f3e37f65e313ae4110dd5ce5dbca0f51801d12e87cb602d36c34993
8b00ebb30366c22ee6d5ef1f83d32875c9d905d431759a2b44a26b1a41f2e5d7
ffc688fdf5a5402bec02f7b2b07547550db12c71a3c7512a5a1aac68aaba4d68
6c2dbe9186cdc0420805503cfe596f45fe60929d00d4cf8d3a2677383ef7dd4c
16429487612585511ff35dabf771265f5b673b77bafcdacd833cb000e7a0bfbd
5b73830e66c1a307283252045a503c3542846f2e2d9a4d81d33f6fb175c56576
9b4f8e528119079279f3c8b7a39648b4513b99478429e38cc4c29f40c16171fe
c4ed389d2a13951afac8a80ed50b7e23fd90f99ae590360a6b7387aff965f104
4cfb81b3b66a709900d796d69de2013dcdc67f71e5c3c6a4424e8193b908fa06
947e2ac7336ec82cf2fe876c1d949021e580f6140ee560050beb441453db11c0
edaa61e2ce893718af9e07c6defee0a4a37cf2741c21ebf464c29d9e5ef49981
93ef79b87e5569ab94a7c5bcfa24cc8b9ecabee5f18ec90352cb00a315afb789

SH256 hash:

9b4aee132a0228378d66a57fda3a2030952309ef74cf2db724ac916b04d8c034

MD5 hash:

93c6391d23c1aa1ed66fb13f82f2ee31

SHA1 hash:

220098c3047c32b51ae13a5cc1e9beeef3da6e18

Link:

https://www.unpac.me/results/89d61aae-7837-4542-857b-b3ec309ede1a/

SH256 hash:

c4ed389d2a13951afac8a80ed50b7e23fd90f99ae590360a6b7387aff965f104

MD5 hash:

4aa7a7f30717b0ae10fbf9b943e91480

SHA1 hash:

7845003b12c664c29944615af5ca207f4eea2469

Link:

https://www.unpac.me/results/89d61aae-7837-4542-857b-b3ec309ede1a/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c4ed389d2a13/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/c4ed389d2a13951afac8a80ed50b7e23fd90f99ae590360a6b7387aff965f104

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	LokiBot Create hunting rule
Author:	kevoreilly
Description:	LokiBot Payload

Rule name:	malware_Lokibot_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe c4ed389d2a13951afac8a80ed50b7e23fd90f99ae590360a6b7387aff965f104

(this sample)

Cape

https://www.capesandbox.com/analysis/301155/

URLhaus

https://urlhaus.abuse.ch/url/2271591/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample