MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c996958847954d1197a2214aa5d513d58c4367b9813b8124bf77d52711c3b83c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 14

Intelligence 14 IOCs YARA File information Comments 1

SHA256 hash:	c996958847954d1197a2214aa5d513d58c4367b9813b8124bf77d52711c3b83c
SHA3-384 hash:	dc33928c43cf509058122a3aee0a243f15ac0beca995423ebdbb4f55f69640383faeae03fb86076a2e34db11d0873dc7
SHA1 hash:	6734b1c574b7d3fb45018e605602e7e2b0fc0ef3
MD5 hash:	a48eb033615ac6e609ac0d337d6332c8
humanhash:	social-uranus-autumn-juliet
File name:	a48eb033615ac6e609ac0d337d6332c8
Download:	download sample
Signature	Loki Create hunting rule
File size:	300'544 bytes
First seen:	2021-11-08 09:44:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ad35223e42e488e819f8bab49b2709bc (8 x RedLineStealer, 3 x RaccoonStealer, 1 x DanaBot)
ssdeep	6144:J7VfD0jAE33OZ2vikbK0OHuzbgwu6L7ITsqSigaTwVf:J7Vb0FOii6KXunnn7s
Threatray	5'360 similar samples on MalwareBazaar
TLSH	T1E2549EF276A8D872D9932D3084708BB05E3BBC56D5205026B274675E2EB3ADC56F133E
File icon (PE):
dhash icon	fcfcb4f4d4d4d8c0 (19 x RedLineStealer, 16 x RaccoonStealer, 14 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

127

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/203230/

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware lockbit packed

Link:

https://www.filescan.io/uploads/6188f1a0d8143ea269ce6c74/reports/3392d356-7d47-428c-9f82-3d58d0de94db/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e25f7940-9c16-4023-86c8-6a8f226c0d3e

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/885148

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/c996958847954d1197a2214aa5d513d58c4367b9813b8124bf77d52711c3b83c/

Threat name:

Win32.Trojan.Fragtor

Status:

Malicious

First seen:

2021-11-08 09:45:07 UTC

AV detection:

25 of 45 (55.56%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zgljlcchsvgrdf5ceffklvit2wgegz5zqe5ycjf7o7ksoeodxa6a._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/211108-lq3gjsbff9/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

outlook_office_path

outlook_win_path

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://63.250.40.204/~wpdemo/file.php?search=386869
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php