MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd9ccf3f16c2d3733cfa52a60c6364ac7219cf79eab6f956ce4726adc2ac53a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 13

Intelligence 13 IOCs YARA 3 File information Comments

SHA256 hash:	cd9ccf3f16c2d3733cfa52a60c6364ac7219cf79eab6f956ce4726adc2ac53a4
SHA3-384 hash:	2039156d90204e71d3b2e7034ee2a7526693172f8e7304190349498ad82cdf1c7c54b21fc5bd20561b2b212eac201bf5
SHA1 hash:	4923bd62b9f3cde554a8cb0d4c641c95d3e92576
MD5 hash:	179d86dc17e0e9ab04518b9733a5366f
humanhash:	stream-muppet-cup-nine
File name:	Notice of DHL shipment delivery details.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	616'944 bytes
First seen:	2023-08-17 18:24:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d4b94e8ee3f620a89d114b9da4b31873 (90 x GuLoader, 18 x njrat, 9 x RemcosRAT)
ssdeep	12288:fBfIP7r9r/+ppppppppppppppppppppppppppppp0YuUj4o1m3qKJakEOBZeXSsB:S1MuPGvOBZeXpRj
Threatray	1'531 similar samples on MalwareBazaar
TLSH	T100D4BEC5E98455A0DD59AB706A32CD358223BDFDA834A41E2ADE3E273FFB3935025053
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	d4c4c4d8ccd4f0cc (241 x AgentTesla, 65 x Loki, 41 x Formbook)
Reporter	abuse_ch
Tags:	DHL exe Loki signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:	sha256WithRSAEncryption
Valid from:	2023-03-23T08:40:41Z
Valid to:	2026-03-22T08:40:41Z
Serial number:	480545a0910aa454c630141469f38f985bd18175
Thumbprint Algorithm:	SHA256
Thumbprint:	d8d953c310f8a130077a624d974f10b80250e9c3f74ff9335ada415afba672d3
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

316

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Notice of DHL shipment delivery details.exe

Verdict:

Suspicious activity

Analysis date:

2023-08-17 19:03:11 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9cfea8e9-dbbb-4170-bd73-75c3c1451c43

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/443311/

Detection(s):

SecuriteInfo.com.Trojan.Loader.1694.18785.30474.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %AppData% subdirectories

Creating a file in the %temp% subdirectories

Gathering data

Verdict:

Malicious

Labled as:

Downloader/GuLoader

Link:

https://www.hybrid-analysis.com/sample/cd9ccf3f16c2d3733cfa52a60c6364ac7219cf79eab6f956ce4726adc2ac53a4

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/aa2852d4-9889-4d0c-9f54-6ba792deee1a

Result

Threat name:

GuLoader, Lokibot

Detection:

malicious

Classification:

troj.evad.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1293140

Signature

Antivirus detection for URL or domain

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Initial sample is a PE file and has a suspicious name

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected GuLoader

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cd9ccf3f16c2d3733cfa52a60c6364ac7219cf79eab6f956ce4726adc2ac53a4/

Threat name:

Win32.Trojan.Nemesis

Status:

Malicious

First seen:

2023-08-17 15:30:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

11 of 38 (28.95%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zwom6pywyljxgph2kktayy3evrzbtt3z5k3psvwoi4tk3qvmkosa._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:guloader family:lokibot downloader spyware stealer trojan

Link:

https://tria.ge/reports/230817-w2l9tadf4x/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Checks QEMU agent file

Loads dropped DLL

Reads user/profile data of web browsers

Guloader,Cloudeye

Lokibot

Malware Config

C2 Extraction:

http://216.128.145.196/~wellseconds/?p=9651
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27

MD5 hash:

ee260c45e97b62a5e42f17460d406068

SHA1 hash:

df35f6300a03c4d3d3bd69752574426296b78695

Link:

https://www.unpac.me/results/0d81bcec-46c7-48d2-a8d8-fdab0f5a8727/

SH256 hash:

cd9ccf3f16c2d3733cfa52a60c6364ac7219cf79eab6f956ce4726adc2ac53a4

MD5 hash:

179d86dc17e0e9ab04518b9733a5366f

SHA1 hash:

4923bd62b9f3cde554a8cb0d4c641c95d3e92576

Detections:

win_cannon_auto

Link:

https://www.unpac.me/results/0d81bcec-46c7-48d2-a8d8-fdab0f5a8727/

Malware family:

GuLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cd9ccf3f16c2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cd9ccf3f16c2d3733cfa52a60c6364ac7219cf79eab6f956ce4726adc2ac53a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	win_cannon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

exe cd9ccf3f16c2d3733cfa52a60c6364ac7219cf79eab6f956ce4726adc2ac53a4

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/443311/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample