MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cafc8e94432ddeb1dab209f0dff728282ee7dc66d4ff4725ff8409eb3cf0c2e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 10

Intelligence 10 IOCs YARA 8 File information Comments

SHA256 hash:	cafc8e94432ddeb1dab209f0dff728282ee7dc66d4ff4725ff8409eb3cf0c2e5
SHA3-384 hash:	ac8ce7b943130a777654bb14d0d92330bea30882dd6a03f684b46fdb16f4e09deda33b833ebd98364b9647b3dcc2035e
SHA1 hash:	9e17a8031efb16a8404fa07b91a48073e9e59b79
MD5 hash:	280f1d0e4acb258ddd5dfe4863ca1e41
humanhash:	crazy-river-edward-king
File name:	yqgfkacF46F6MMR.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	1'061'376 bytes
First seen:	2020-11-24 14:05:19 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	24576:6ZnCeHjD8GG2T1y95TT1UTLxvyNigKBlnv:6MSqY1kDmLx4ig
Threatray	2'035 similar samples on MalwareBazaar
TLSH	8C356C9C729071EEC46BD1758EA82C64EB90386B831B4607B42F10AD9F5C987DF245FB
Reporter	ffforward
Tags:	exe Loki Lokibot

Intelligence

File Origin

# of uploads :

# of downloads :

863

Origin country :

n/a

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Reading critical registry keys

Creating a file

Changing a file

Replacing files

DNS request

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Stealing user critical data

Moving of the original file

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/546067

Signature

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM_3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cafc8e94432ddeb1dab209f0dff728282ee7dc66d4ff4725ff8409eb3cf0c2e5/

Threat name:

ByteCode-MSIL.Trojan.LokiBot

Status:

Malicious

First seen:

2020-11-24 10:27:46 UTC

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zl6i5fcdfxpldwvsbhyn75zifaxopxdg2t7uojp7qqe6wphqylsq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/201124-pwfk1pcpea/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: RenamesItself

Suspicious use of SetThreadContext

Lokibot

Malware Config

C2 Extraction:

http://legalpath.in/cc/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

cafc8e94432ddeb1dab209f0dff728282ee7dc66d4ff4725ff8409eb3cf0c2e5

MD5 hash:

280f1d0e4acb258ddd5dfe4863ca1e41

SHA1 hash:

9e17a8031efb16a8404fa07b91a48073e9e59b79

Link:

https://www.unpac.me/results/12abbf26-2f6b-43e3-bb6c-7c630b46a054/

SH256 hash:

cc81ad8bc9be99e99e3f345d5a57759702d53790e488eafbf3d89f71d4991da0

MD5 hash:

92c606d05757f4fec03ba967e4371f60

SHA1 hash:

05e6d07b220514f08f2a61299783b5687063f970

Link:

https://www.unpac.me/results/12abbf26-2f6b-43e3-bb6c-7c630b46a054/

SH256 hash:

c8671a87d685f2354d96f3cfcad530dfa5f3ec535a0f5ec14940d81fb857813b

MD5 hash:

b5358f677850210361f573c7d249c258

SHA1 hash:

215e06e319515d779efa88f7c05b343d6ec3f6a5

Link:

https://www.unpac.me/results/12abbf26-2f6b-43e3-bb6c-7c630b46a054/

SH256 hash:

c6fcf5d515d56cf746b4c4aa4695f11e9ad7f6063a96cda810bf39dc47c5a7a0

MD5 hash:

47509d9db24c975e55c287afdc459fad

SHA1 hash:

4f1f893555c985d7cbba731cf1fdbf49c6ecf793

Link:

https://www.unpac.me/results/12abbf26-2f6b-43e3-bb6c-7c630b46a054/

SH256 hash:

b00a8daeabd503e2ca4cf4d7d9007897826cd6d700cc05c71b815812b46c88a7

MD5 hash:

8a1da4dd17a8f68fb49108663a01f0d1

SHA1 hash:

bafe5ce4c9179a5681c4acf9db63decb7225798d

Detections:

win_lokipws_g0

win_lokipws_auto

Link:

https://www.unpac.me/results/12abbf26-2f6b-43e3-bb6c-7c630b46a054/

Parent samples :

13c97960ce699059f5b203f947f1cf7fed4fe5bd0a848758a1ada711ea47556b
2ba0946dcc8c383ad7b637fa883684245320a8cc9eee0b8a1d59232cdec9c6e7
c6d32cce563241de2f9137ed8a1812a2413cbed6f84d4d6870202fa0fcd1e01e
bcb80a1836e307e6deddd288ef33138eb90da86887eeec7baa7c2944496e5b48
cafc8e94432ddeb1dab209f0dff728282ee7dc66d4ff4725ff8409eb3cf0c2e5

SH256 hash:

154efa62c97b291bc19d0a0f9ab89f3b957846b88d72f5d4bfff27398c41ad8b

MD5 hash:

2a5e0db21d0c3c483bd9e0b23eacbe4a

SHA1 hash:

e33ef00123d3c8a4de7f84c95ef9ab9693616cfa

Link:

https://www.unpac.me/results/12abbf26-2f6b-43e3-bb6c-7c630b46a054/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AgentTesla

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cafc8e94432ddeb1dab209f0dff728282ee7dc66d4ff4725ff8409eb3cf0c2e5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	Lokibot Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

exe cafc8e94432ddeb1dab209f0dff728282ee7dc66d4ff4725ff8409eb3cf0c2e5

(this sample)

Delivery method

Distributed via e-mail attachment

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample