MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d324d33233edf16f00bb4c9a06a14eee0ef15f8d90a3b9f62213e0ea9054312d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 11


Intelligence 11 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d324d33233edf16f00bb4c9a06a14eee0ef15f8d90a3b9f62213e0ea9054312d
SHA3-384 hash: d2e8cb1f8993076fca7af39cef3ff27c72c72fefe6392fb3cdf89bc4e8a2600fe5581585999a0a449f0d81c69b34249c
SHA1 hash: 3d754fcb9b66143664df7a12fc709471a29e4c39
MD5 hash: e50669d67367951aeb58d3aaff69125c
humanhash: green-jig-fruit-twenty
File name:D324D33233EDF16F00BB4C9A06A14EEE0EF15F8D90A3B.exe
Download: download sample
Signature Loki
Create hunting rule
File size:825'347 bytes
First seen:2021-06-18 00:41:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b126334c43a3b8f2e951f0ec1caca9f6 (1 x Loki)
ssdeep 12288:iJhmptoDU+KeU5UQ9m5tCt1b+BQckAH2z5OtNArniZpcM:elvPXC1biDHTNArMmM
Threatray 3'230 similar samples on MalwareBazaar
TLSH E6055CE2A39B1476D19312748FEF85B8DCB5FD032925944326F22D29DE393C2971A393
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://faski.nut.cc/b-slek-t/fred.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://faski.nut.cc/b-slek-t/fred.php https://threatfox.abuse.ch/ioc/135597/

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
D324D33233EDF16F00BB4C9A06A14EEE0EF15F8D90A3B.exe
Verdict:
No threats detected
Analysis date:
2021-06-18 01:00:59 UTC
Tags:
installer
Link:
https://app.any.run/tasks/ecab3ebe-d9c6-4217-906b-4b2a3111e078

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/166675/
Detection(s):
Win.Malware.Generic-6651342-0
Create hunting rule

Win.Malware.Generic-6652609-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/de4e2caf-0f8b-4fcf-90ff-95bdbe82dd2e
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/804045
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Creates files in alternative data streams (ADS)
Drops VBS files to the startup folder
Found malware configuration
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 436457 Sample: D324D33233EDF16F00BB4C9A06A... Startdate: 18/06/2021 Architecture: WINDOWS Score: 100 33 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->33 35 Found malware configuration 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 6 other signatures 2->39 7 D324D33233EDF16F00BB4C9A06A14EEE0EF15F8D90A3B.exe 4 2->7         started        11 wscript.exe 1 2->11         started        process3 file4 21 C:\Users\user\AppData\Roaming\...\explor.exe, PE32 7->21 dropped 23 C:\Users\user\...\explor.exe:Zone.Identifier, ASCII 7->23 dropped 49 Creates files in alternative data streams (ADS) 7->49 51 Contains functionality to detect sleep reduction / modifications 7->51 13 explor.exe 1 7->13         started        signatures5 process6 file7 25 C:\Users\user\AppData\Roaming\...\expb.vbs, ASCII 13->25 dropped 53 Antivirus detection for dropped file 13->53 55 Multi AV Scanner detection for dropped file 13->55 57 Tries to steal Mail credentials (via file registry) 13->57 59 3 other signatures 13->59 17 explor.exe 54 13->17         started        signatures8 process9 dnsIp10 27 cdl-lb-1356093980.us-east-1.elb.amazonaws.com 34.231.160.63, 49720, 49721, 49722 AMAZON-AESUS United States 17->27 29 192.168.2.1 unknown unknown 17->29 31 2 other IPs or domains 17->31 41 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->41 43 Tries to steal Mail credentials (via file access) 17->43 45 Tries to harvest and steal ftp login credentials 17->45 47 Tries to harvest and steal browser information (history, passwords, etc) 17->47 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d324d33233edf16f00bb4c9a06a14eee0ef15f8d90a3b9f62213e0ea9054312d/
Threat name:
Win32.Trojan.Delpem
Create hunting rule
Status:
Malicious
First seen:
2018-08-15 17:41:00 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2msngmrt5xyw6af3jsnaniko5yhpcx4nscr3t5rccpqovecugewq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
012c98fa766957b510c96eafcf27545deef616fe356a066c172c2426d373dbec
Loki
37d784463964139b15ff2609fc173c430482c6feebef4a13a37df143e99468e5
Loki
47aa20a304624dbf8b71da1804f3f848ab12f2797390d0788067b542dc2c6a9c
Loki
6f50c600f53b85a60bde27afe5305968f221f92e40cb2e4e5b2c7f4b53fd9a31
Loki
76e663fac059a1659275bf54e20ee9ee4667fdbd0c7a7a7c40b4fa472ce4e186
Loki
87626640140d28f12ad7797fb1a99db9e448cea959f452664873f81231cb9087
Loki
c4039980d8050f9deeba61533e38ffff74571e48f7304940825852c2cf8f0932
Loki
d3094f4cde32854f985a9dca4d520adefe3f561c30aba28ed62e93e56eebdf3d
Loki
f9e2dd756af048e97443fedcca614a9ef3ff969c10287856bf8c3e05abb881e1
Loki
fc27d5975a0b1b0f856f57dd5839cd081efde7a6fc228a5ddbdb57ef4bf1a9c3
Loki
+ 3'220 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210618-mvxg2n5jhe/
Behaviour
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Loads dropped DLL
Executes dropped EXE
Lokibot
Malware Config
C2 Extraction:
http://faski.nut.cc/b-slek-t/fred.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
b8608df9573af27744e7cc0eb6f6f406ed1fba9efd74425b35277776487c3495
MD5 hash:
c7afe51f016c87e23151cec4a7d0cbc1
SHA1 hash:
5dc0dd9e66802e4d2d768563119d6821c274560d
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/c05da110-3903-4e57-adc5-8c5c591db711/
SH256 hash:
d324d33233edf16f00bb4c9a06a14eee0ef15f8d90a3b9f62213e0ea9054312d
MD5 hash:
e50669d67367951aeb58d3aaff69125c
SHA1 hash:
3d754fcb9b66143664df7a12fc709471a29e4c39
Link:
https://www.unpac.me/results/c05da110-3903-4e57-adc5-8c5c591db711/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d324d33233edf16f00bb4c9a06a14eee0ef15f8d90a3b9f62213e0ea9054312d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/166675/

Comments