MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d05da0ea64354f6f822816807184f7a9e6e3654c7e8197331014722513c68cc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d05da0ea64354f6f822816807184f7a9e6e3654c7e8197331014722513c68cc5
SHA3-384 hash: 92011822aa97fd0ce447cf0ce7670c5c65456c85ceed23f358ffb4c76d88b4fb535f6371db36ddf00da68a252d92fe60
SHA1 hash: b3d401b95bd120802ea5f96b6862135cff7e0d23
MD5 hash: 78003d230494a900a84d0baa9f6fd058
humanhash: queen-nebraska-lemon-south
File name:scan 10188839.exe
Download: download sample
Signature Loki
Create hunting rule
File size:973'312 bytes
First seen:2022-03-20 21:45:58 UTC
Last seen:2022-03-20 23:50:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:c9v97LszfQqpFlC+MHXVxsZhycNj5bodU:kFUzfJpuLV0wcJ+dU
Threatray 6'753 similar samples on MalwareBazaar
TLSH T14D25136537B64716C9B997F1081650A127F2109FFA02E30EBD5A61CE8D22F134727BBB
Reporter GovCERT_CH
Tags:exe Loki

Intelligence

File Origin
# of uploads :
2
# of downloads :
298
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/253127/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.39298926.353.14651.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Reading critical registry keys
Enabling the 'hidden' option for analyzed file
Moving of the original file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe obfuscated packed update.exe
Link:
https://www.filescan.io/uploads/6237a09eb94fb38cb4bca1cf/reports/6bea18a6-bb12-45b5-8166-517c256dfa5c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/17dccf71-aa5c-453b-94a5-554db4e94cc9
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/960324
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d05da0ea64354f6f822816807184f7a9e6e3654c7e8197331014722513c68cc5/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-03-20 12:17:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
19 of 42 (45.24%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2bo2b2tegvhw7aric2ahdbhxvhtogzkmp2azomyqcrzcke6grtcq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
3851e1c8c896ecae1035576a4b37d1fafa0690df428e255ed709c155cf77279c
Loki
944220c5aff35e369c250d000c287223061bc5acbc7df5b3209fb526685ddde9
Loki
a306a3946f4b31aa9c89320318bd2060a71077850d735ec94fe1cef950d0d9d3
Loki
ed3f0ebaf7e2a0e41e1fa77a948134c795aaf31f9813f16d8a65c54354e1a90b
Loki
facd3ee7d90d6e48d48aebc76752a5ada6b9fa1df7c954661f53e83a14bb744d
Loki
+ 6'743 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer suricata trojan
Link:
https://tria.ge/reports/220320-1mmdgsgfbm/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://164.90.194.235/?id=69293141502505011
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
6ff21c090296e9fd3ec2b17e03e184e2396adf4013b2a4f4c9dea5bd7aff38f7
MD5 hash:
7c3fb3e3d91e338ae917c4cb46895e71
SHA1 hash:
ba577b8ccb3c6bbc5e9e3a838aec98859cd4dbaa
Link:
https://www.unpac.me/results/4c9cd042-9bb8-461c-95ce-25f96ffd5e6d/
SH256 hash:
59d030e2b9685decc020cfd2f69113116bb3931d8ece1b5148278981e1cb1e78
MD5 hash:
5f35f6768812c32a2430dfa9b12b0589
SHA1 hash:
ace138dbd58fe17b90d912ae15318b5cb61646e2
Link:
https://www.unpac.me/results/4c9cd042-9bb8-461c-95ce-25f96ffd5e6d/
SH256 hash:
8052f19d2cc0f72813f95ecd61e77144db8eac5b8197ed52ebef541e38241d4f
MD5 hash:
2b2e1db845c6c9eba701dcceab0ef79f
SHA1 hash:
ab18c1a64adc5e033279e309a3fd7a189c918b66
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/4c9cd042-9bb8-461c-95ce-25f96ffd5e6d/
Parent samples :
facd3ee7d90d6e48d48aebc76752a5ada6b9fa1df7c954661f53e83a14bb744d
d05da0ea64354f6f822816807184f7a9e6e3654c7e8197331014722513c68cc5
2269a69ccc3ae635d89bcf5860aecdafc37f063c5c52f37822c40ba2a496af55
4d8b9771e44c71f5d5442559fad0b99581c6e33b339af9ecec54095a18aafe82
32b20e8f7149db647ede3aba8219380f8f910b73fef5c32d03141a647f981976
SH256 hash:
16892ab418d7ef581c590018b410521d0d6f0020ac12d3e113b8eeda758d9641
MD5 hash:
933cd5fb05d6a0bcfd1335995ab6d8ff
SHA1 hash:
2652334b75e4db6d7fb521b458d9d5b495eb0ebe
Link:
https://www.unpac.me/results/4c9cd042-9bb8-461c-95ce-25f96ffd5e6d/
SH256 hash:
d05da0ea64354f6f822816807184f7a9e6e3654c7e8197331014722513c68cc5
MD5 hash:
78003d230494a900a84d0baa9f6fd058
SHA1 hash:
b3d401b95bd120802ea5f96b6862135cff7e0d23
Link:
https://www.unpac.me/results/4c9cd042-9bb8-461c-95ce-25f96ffd5e6d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/d05da0ea64354f6f822816807184f7a9e6e3654c7e8197331014722513c68cc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Executable exe d05da0ea64354f6f822816807184f7a9e6e3654c7e8197331014722513c68cc5

(this sample)

  
Dropped by
loki
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/253127/

Comments