MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca7ba4969de206f21d0ec848f0fd0fb56bc4f52bb8557f9a253baf48cbdc8a88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca7ba4969de206f21d0ec848f0fd0fb56bc4f52bb8557f9a253baf48cbdc8a88
SHA3-384 hash: 94d016b20f6aa4eedf7e43a34fa970edf53e82a444c7bb58c0fba17f5e3178c5fc73bb053852b364d0f0fb789285313e
SHA1 hash: 2137370da81cf4d3f5e7f92b78338dd2a53d221c
MD5 hash: 1d0cfeae51547141fd3491bc4fa36b98
humanhash: arizona-ceiling-lima-vermont
File name:Proforma Invoice.exe
Download: download sample
Signature Loki
Create hunting rule
File size:884'736 bytes
First seen:2021-06-15 10:54:42 UTC
Last seen:2021-06-15 11:51:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:IySMPQipP5PQSLWzcGZjeG/HhhGKtQ6uK4OB3uODj5+xsWnFV7b5X6ARciBpDy:INip6SLW5/dtuOBdcsWV53
Threatray 874 similar samples on MalwareBazaar
TLSH 4E15BF534ECF866AD2644DB66731AC4782325DE92948B3223EC035BDD9372EDD8EF901
Reporter GovCERT_CH
Tags:exe Loki

Intelligence

File Origin
# of uploads :
2
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Proforma Invoice.exe
Verdict:
Malicious activity
Analysis date:
2021-06-15 10:58:32 UTC
Tags:
trojan lokibot stealer
Link:
https://app.any.run/tasks/7f721c14-7f38-4f70-89a8-95177757008d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/166466/
Detection(s):
SecuriteInfo.com.Variant.MSILHeracles.18339.22190.18767.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Using the Windows Management Instrumentation requests
Creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/807da086-2afd-4bf7-9a50-d392065ccffe
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/802324
Signature
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ca7ba4969de206f21d0ec848f0fd0fb56bc4f52bb8557f9a253baf48cbdc8a88/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-14 22:59:39 UTC
AV detection:
18 of 46 (39.13%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zj52jfu54idpehiozbepb7ipwvv4j5jlxbkx7grfhoxurs64rkea._file
Verdict:
unknown
Similar samples:
1cff6ac43c1bd21886487da201d509090058fdc1b584b064c13e65efc4c376ff
Loki
34b139e4a330ce4ae1572f70947218d40d0cf00864bc23ed41d02648966344db
Loki
3f33e7bde9dcaafa436e0cb2e267371768115ea14de2a9860cefa74af71e9155
Loki
60da286e39c0c6dcee0d9daafbf5c6662b818c9a36b77d8ba5f4314e94d9baea
Loki
68c7c81b15818419222a9c58550c72c78d30856ccde7a6fe4fc1a096fcd6f064
Loki
759c67a815022fb8b185236d3b2f25c2d009c8e9ff8bf3571e339dc2e2473d93
Loki
a83fc1372384a42b479adbba691e5de280f53df2045b1b7246d05f6003dac8af
Loki
aba81a1155ddb5054a5c433eab88203d7551fa52296a98c0f5e376b479da1795
Loki
cf13202e5434ed24d8aa3c5c726735a4b3937269f44963bd6476467b63ab8a5e
Loki
d8898abdff69091eec6ceb105dde20d1787f47e9835645a3e5ea256f86d07d32
Loki
+ 864 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot evasion spyware stealer trojan
Link:
https://tria.ge/reports/210615-16qk21q5wn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Lokibot
Malware Config
C2 Extraction:
http://63.141.228.141/32.php/cViU8nooOLcrF
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
4f5f76af19949ba368f040c7b2b7cf7159b1da46f6d8e61395394d9716f0a376
MD5 hash:
4027284609db9d15f48b81650dd6ad03
SHA1 hash:
bea8647bf646af97a6e48be7d34de2ca406b5ae8
Link:
https://www.unpac.me/results/17aae9cc-0d4e-461b-8785-9f701e55aef8/
SH256 hash:
5bede9eedf6ae6df5a9d587c116c9583b31474c159c2b53486b000093cb3fde6
MD5 hash:
072eeac61b35d3f09edee4ff4f80f52d
SHA1 hash:
696fd9905a47e526470c2e234fef32f1ec1b74ad
Link:
https://www.unpac.me/results/17aae9cc-0d4e-461b-8785-9f701e55aef8/
SH256 hash:
54dce26d121d93fb08fa304d03c4e0634646e6ea752a709c290e4e39aff372b1
MD5 hash:
b2819948609f4f949a69c1470e5f5360
SHA1 hash:
42442c11dcd06a0c3d6dac166a9e558e4fea0521
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/17aae9cc-0d4e-461b-8785-9f701e55aef8/
Parent samples :
35a4ba4437a87a34f0916a03c74368b247c212464d0defb97cf2700fd9a337d4
ca7ba4969de206f21d0ec848f0fd0fb56bc4f52bb8557f9a253baf48cbdc8a88
SH256 hash:
ca7ba4969de206f21d0ec848f0fd0fb56bc4f52bb8557f9a253baf48cbdc8a88
MD5 hash:
1d0cfeae51547141fd3491bc4fa36b98
SHA1 hash:
2137370da81cf4d3f5e7f92b78338dd2a53d221c
Link:
https://www.unpac.me/results/17aae9cc-0d4e-461b-8785-9f701e55aef8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ca7ba4969de206f21d0ec848f0fd0fb56bc4f52bb8557f9a253baf48cbdc8a88

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Executable exe ca7ba4969de206f21d0ec848f0fd0fb56bc4f52bb8557f9a253baf48cbdc8a88

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/166466/

Comments