MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd82528c1dd172d20632369ad7f34cdfad3945a610754764c045740d96b717fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 13

Intelligence 13 IOCs YARA File information Comments

SHA256 hash:	cd82528c1dd172d20632369ad7f34cdfad3945a610754764c045740d96b717fe
SHA3-384 hash:	2f2fa454e3cd45773eeb25dd0b4b81224d2f54df042adbbf3e0d38bb607e8242252ff91052941addce14c97e4cc1ccc9
SHA1 hash:	af8f1666a217fdad415dc294e5abbd294810aed6
MD5 hash:	5c057d1e8206626f6ec67db4d225876b
humanhash:	yellow-dakota-delaware-don
File name:	Receipt.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	134'656 bytes
First seen:	2021-01-19 13:00:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	43f1b4fb55ffa0f3576d845e7070130e (5 x Loki, 5 x Formbook, 4 x AgentTesla)
ssdeep	3072:lOOrCpB4WzA72gOybXal4ldZJNZM/wNFkqcGuoFX:IOrCpB44u2kXQSoGJOiX
Threatray	2'475 similar samples on MalwareBazaar
TLSH	4CD3F18676CCDF36E0D6D1F01E6160DF4E271181A39350A797C97CFAA16E9C2E878A0D
Reporter	abuse_ch
Tags:	DHL exe Loki

abuse_ch

Malspam distributing Loki:

HELO: ycg0.frftru.ga
Sending IP: 134.122.43.65
From: DHL Global <contacts.cn@frftru.ga>
Subject: DHL Arrival Notice: Parcel delivery & tracking
Attachment: Receipt.gz (contains "Receipt.exe")

Loki C2:
http://51.195.53.221/p.php

Intelligence

File Origin

# of uploads :

# of downloads :

147

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Receipt.exe

Verdict:

Malicious activity

Analysis date:

2021-01-19 13:06:26 UTC

Tags:

trojan lokibot stealer

Link:

https://app.any.run/tasks/2bc91810-3ed5-4fd2-bfab-22cb496bcf96

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/112884/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Unauthorized injection to a recently created process

Reading critical registry keys

Changing a file

Replacing files

Connection attempt

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Sending a UDP request

Stealing user critical data

Moving of the original file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/585101

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/cd82528c1dd172d20632369ad7f34cdfad3945a610754764c045740d96b717fe/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2021-01-19 09:59:50 UTC

AV detection:

20 of 28 (71.43%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zwbffda52fznebrsg2nnp42m36wtsrngcb2uozgaiv2a3fvxc77a._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/210119-k2rwjp9krs/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Lokibot

Malware Config

C2 Extraction:

http://51.195.53.221/p.php/Ezw3qu5lmvRXE
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php