MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce79401a906246017cec719b5a89b228c0589704f04f962de647bbd34e5e1b2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 17

Intelligence 17 IOCs YARA File information Comments

SHA256 hash:	ce79401a906246017cec719b5a89b228c0589704f04f962de647bbd34e5e1b2d
SHA3-384 hash:	3a75f3cad2dde80bb2fb18fcda6312aae59230e5e652206dfb1bd84c175d19b407b7d1f8b13e90e7d1da02c6eb8cb7b3
SHA1 hash:	ba2ae29786b84055d84e31b61518aa5413d98557
MD5 hash:	227a0b7bffeeae252c005ed273ecd5c3
humanhash:	hamper-diet-avocado-violet
File name:	SecuriteInfo.com.Packed-GDT227A0B7BFFEE.19189.10239
Download:	download sample
Signature	Loki Create hunting rule
File size:	303'104 bytes
First seen:	2022-03-08 21:42:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	30b61c273b1d343ed1b1e7a06292b7df (5 x Gozi, 1 x RaccoonStealer, 1 x Loki)
ssdeep	3072:lxtScnUi75L1oPImvXiTvojxbbWaOtbP0Ax0b50tVggjcGkNIVqIQuHq3:pPnUC5L1oPI5wjxbbycMv7ITsq8C
Threatray	6'735 similar samples on MalwareBazaar
TLSH	T11D54CFD1BE90C83AE0427530E825CAE15A7BF872DA7489477778DB2E1E313C29A75316
File icon (PE):
dhash icon	367e7c7f727e6e72 (2 x Stop, 1 x Loki)
Reporter	SecuriteInfoCom
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

226

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

http://198.23.156.251/23/vbc.exe

Verdict:

Suspicious activity

Analysis date:

2022-03-08 22:41:24 UTC

Tags:

opendir loader

Link:

https://app.any.run/tasks/130d5ec3-5118-4808-a735-8e5d6da3093a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

LokiBot

Link:

https://www.capesandbox.com/analysis/248504/

Detection(s):

SecuriteInfo.com.Packed-GDT227A0B7BFFEE.19189.10239.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Reading critical registry keys

Changing a file

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for analyzed file

Stealing user critical data

Moving of the original file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/8682/overview

Behaviour

SystemUptime

MeasuringTime

EvasionGetTickCount

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

emotet greyware racealer smokeloader

Link:

https://www.filescan.io/uploads/6227cdaeb94fb38cb4413d80/reports/c3379bb3-8a1c-4625-9144-6f3354689ec8/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3f1a9602-a429-4e17-852c-5a28c5800ec3

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/953017

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/ce79401a906246017cec719b5a89b228c0589704f04f962de647bbd34e5e1b2d/

Threat name:

Win32.Trojan.Tnega

Status:

Malicious

First seen:

2022-03-08 17:08:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

31 of 42 (73.81%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zz4uaguqmjdac7hmognvvcnsfdafrfye6bhzmlpgi655gts6dmwq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Loki

1e36f8b1165ea81970aff36a7b13fe4bdd02f4bf95b08f634ea446d0668de24f

Loki

6f975378cb65fa40e27b22cd6676e4385b46cdb0df3111cb94530a8615516281

Loki

8736334fb15c7ff407900e746c9a3a0d2db66226d15c28fa3151f09604f84b89

Loki

cb59cd4c7a4896aab48aa27530bb65363920e5da091eec1aa2bdb538f9ae1491

Loki

+ 6'725 additional samples on MalwareBazaar

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220308-1kb5qsecdq/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

outlook_office_path

outlook_win_path

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://164.90.194.235/?id=22044231991792986
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php