MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7dde97327bfb96762a70d54b6e9a98ab973d39520de7f7cb1f475654cb8ae8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 16

Intelligence 16 IOCs YARA 2 File information Comments

SHA256 hash:	c7dde97327bfb96762a70d54b6e9a98ab973d39520de7f7cb1f475654cb8ae8b
SHA3-384 hash:	2f4322c92400f0a207945179cb152fb57350a485f565bd14476b79fcf27760c9184f59dcece467884e2cd78a1683b8fa
SHA1 hash:	39010b48dc9697a8610480dbc662d2900eae1595
MD5 hash:	4b4381a4e64200ea42691343eb32e09e
humanhash:	single-timing-kilo-mars
File name:	Payment Slip copy.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	652'288 bytes
First seen:	2022-06-09 13:35:34 UTC
Last seen:	2022-06-09 20:10:20 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'473 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:iP9C8+jXbW9qT9q0LzW4S6O4CUbIjAl3TcbGU5XcqPno+qa:iPlCXKOnLK4VCel3vU51nS
TLSH	T180D41250F2EA52C0F2370FB80C67194286F9479299BBDE3F59B2E98F578F7C5012A152
TrID	72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.4% (.EXE) Win64 Executable (generic) (10523/12/4) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	332363132d353307 (6 x Formbook, 1 x SnakeKeylogger, 1 x Loki)
Reporter	cocaman
Tags:	exe Loki payment

Intelligence

File Origin

# of uploads :

# of downloads :

332

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

lokibot

ID:

File name:

Payment Slip copy.exe

Verdict:

Malicious activity

Analysis date:

2022-06-09 21:22:41 UTC

Tags:

trojan lokibot stealer

Link:

https://app.any.run/tasks/96868139-8947-42bc-b40d-2aa0d0137bb7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/278383/

Detection(s):

SecuriteInfo.com.Variant.Strictor.268676.14238.24299.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a process from a recently created file

Creating a process with a hidden window

Creating a file in the %temp% directory

Launching a process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/62a1f7816aa17a21fc2f14d6/reports/4df5d2e3-1e1e-4bdb-89bb-e7fde3e8f9b0/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/95be61cd-c984-4131-a09d-12cfe9386972

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1010038

Signature

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/c7dde97327bfb96762a70d54b6e9a98ab973d39520de7f7cb1f475654cb8ae8b/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-06-09 11:29:20 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 26 (69.23%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=y7o6s4zhx64woyvhbvkln2njrk4xhu4vedph67fr6r2wktfyv2fq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220609-qv8lksdaa2/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Fake 404 Response

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://sempersim.su/gh8/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

32dd9fb065ab9a0587c1139e3cd48e3455846da9a4890799492b473f33f6af58

MD5 hash:

537294abf308eb1ac9f2f12e0cf32571

SHA1 hash:

8e014ce3fe17d1e4667dccc8a807adcdd3abb9f5

Detections:

win_lokipws_g0

win_lokipws_auto

lokibot

Link:

https://www.unpac.me/results/2ff4a8a5-5345-4818-adbb-48d501e7517f/

Parent samples :

c7dde97327bfb96762a70d54b6e9a98ab973d39520de7f7cb1f475654cb8ae8b
e2716a711f6bb22d2ff77e0da881b24d16b554bc081b6a7d11d23027d4a47670
ef2dd3721941458a0a1c4fdf5971780131c6048c8a51df454b1f52cafbd0eb2e

SH256 hash:

5ba62889c62cf580251052eee05e4bf7759c86917510a68c5ab0a7adfa589a20

MD5 hash:

3738a9b1793159f6eee4dcaa3b386414

SHA1 hash:

60c89834a71c9ed9ae72b6e68da33ce6e6ab5397

Link:

https://www.unpac.me/results/2ff4a8a5-5345-4818-adbb-48d501e7517f/

SH256 hash:

00654a9247778987affac8459fb476527fd360d773488f4ccf75ba4689aaa3ab

MD5 hash:

9a0e170fa167d0a068fb7f89d65b09e8

SHA1 hash:

1581295c8e8de50bf06778938db182d1824c4a42

Link:

https://www.unpac.me/results/2ff4a8a5-5345-4818-adbb-48d501e7517f/

SH256 hash:

4b3059a1fcd6c58c7fc4e574766133e89e95cb0fe6631b7f4aee664370c2571d

MD5 hash:

97f6ddc9c7e648e589849d8d6466bc18

SHA1 hash:

1104888244c872d5726728e0cb05ae6edaabf2bf

Link:

https://www.unpac.me/results/2ff4a8a5-5345-4818-adbb-48d501e7517f/

SH256 hash:

c7dde97327bfb96762a70d54b6e9a98ab973d39520de7f7cb1f475654cb8ae8b

MD5 hash:

4b4381a4e64200ea42691343eb32e09e

SHA1 hash:

39010b48dc9697a8610480dbc662d2900eae1595

Link:

https://www.unpac.me/results/2ff4a8a5-5345-4818-adbb-48d501e7517f/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c7dde97327bf/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c7dde97327bfb96762a70d54b6e9a98ab973d39520de7f7cb1f475654cb8ae8b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.