MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6b9fe566a97bce1c4de2fb6822529ba9c7bae7cb076c6a8827af62b5bdd6699. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6b9fe566a97bce1c4de2fb6822529ba9c7bae7cb076c6a8827af62b5bdd6699
SHA3-384 hash: 874ccce0b0285283010d837cf68ab909518e73cbef709bdf011155d5581bfae3b45d009ba1dfce1614c564f2885e2c07
SHA1 hash: 995518a70d3926312977a38baf5c2bb693f65e5d
MD5 hash: 6a002776c60853052c73bbfe38377877
humanhash: lemon-quiet-nitrogen-helium
File name:scan docJUNE SOA.exe
Download: download sample
Signature Loki
Create hunting rule
File size:748'032 bytes
First seen:2022-07-20 18:55:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:MZ/NzB0WWYVHpmpHZQELSM8atMHUpRU+AwMnH9gLzhiMt2SUamjEFn2VEn6AaFOG:4/Nl05Y4HZxLma6HUXJ8eNiMt2SRrF2b
TLSH T1BAF4F101367C9F96C8BE9BFD6469608003FA271B212ED7194ED6F0DF19BAF504A50E4B
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://sempersim.su/gi21/fre.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://sempersim.su/gi21/fre.php https://threatfox.abuse.ch/ioc/838875/

Intelligence

File Origin
# of uploads :
1
# of downloads :
391
Origin country :
n/a
Vendor Threat Intelligence
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/292986/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.44341.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Reading critical registry keys
Enabling the 'hidden' option for analyzed file
Moving of the original file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62d84fc7ef2b0e63a82a9f84/reports/2b7091bb-cc29-4373-869c-5b8f7eb8a289/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/11744c55-055c-4d9b-92d3-d7e6a9876bd6
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1037847
Behaviour
Behavior Graph:
n/a
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c6b9fe566a97bce1c4de2fb6822529ba9c7bae7cb076c6a8827af62b5bdd6699/
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2022-07-20 09:42:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y2474vtks66odrg6f63iejjjxkohxlt4wb3mnkecpl3cww65m2mq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/220720-xlck4sfed7/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://sempersim.su/gi21/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807
MD5 hash:
db51fe170a9e5d6ec5429a2fbd9d0353
SHA1 hash:
e30a58125fc41322db6cf2ccb6a6d414ed379016
Link:
https://www.unpac.me/results/fc69d4f4-8cef-415c-9481-0109fb0f57f1/
SH256 hash:
9d25bdc4cc6975e72c82dcbd6d150ae1530a074c965e99be7e20ef267b6cde52
MD5 hash:
da975866f3ee950b6e37bf57767e7e14
SHA1 hash:
88570d1fc2a5a8e235feb7907181c6a609fcfdfc
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
lokibot
Create hunting rule
Link:
https://www.unpac.me/results/fc69d4f4-8cef-415c-9481-0109fb0f57f1/
Parent samples :
c6b9fe566a97bce1c4de2fb6822529ba9c7bae7cb076c6a8827af62b5bdd6699
1d11e6881d8e82e183a3f81db9a83d6c5f35ac4944778954071dc4cb0f5f7c2c
a9aa6b1f7a28e4960d0a21ce23e82a54c1ed93c1db59ef9f374e6aa0bef9afce
cc37715e813fc4af520a19a77ecabc14fd3457b9204702d3dab38804eb36d4a3
SH256 hash:
80e335148a7b195d28ebfa1db60bbc7af347234d5838e4f703be6b428ac7223e
MD5 hash:
287d9771a2398becb8055ec11c0f08f0
SHA1 hash:
84cc2f765091457b43dab6cef8cf4d9065439923
Link:
https://www.unpac.me/results/fc69d4f4-8cef-415c-9481-0109fb0f57f1/
SH256 hash:
71200c36f231afc37914895af7bc42ec1c443c8c6ed1b58db049997ee0a093e5
MD5 hash:
ab9d8acc1c3ec73da008f153105ab828
SHA1 hash:
3659f402a70efec79b85916cb8ed0e179f36a2f4
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
lokibot
Create hunting rule
Link:
https://www.unpac.me/results/fc69d4f4-8cef-415c-9481-0109fb0f57f1/
SH256 hash:
781c78f48dc35cb66432bd1826965cc59fb100d4d12c04432a2c92361f8364c3
MD5 hash:
4bfe50310c7b0dd87da13cc6109f0190
SHA1 hash:
2e3cfcf114927e004ea7788b29e5dc45c5f9e246
Link:
https://www.unpac.me/results/fc69d4f4-8cef-415c-9481-0109fb0f57f1/
SH256 hash:
c6b9fe566a97bce1c4de2fb6822529ba9c7bae7cb076c6a8827af62b5bdd6699
MD5 hash:
6a002776c60853052c73bbfe38377877
SHA1 hash:
995518a70d3926312977a38baf5c2bb693f65e5d
Link:
https://www.unpac.me/results/fc69d4f4-8cef-415c-9481-0109fb0f57f1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/c6b9fe566a97bce1c4de2fb6822529ba9c7bae7cb076c6a8827af62b5bdd6699

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:LokiBot
Create hunting rule
Author:kevoreilly
Description:LokiBot Payload
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/292986/

Comments