MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d487bf902cec912284ea567e44b6070591f96b9385beccc9e29d745026eca3c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 16

Intelligence 16 IOCs YARA 2 File information Comments 1

SHA256 hash:	d487bf902cec912284ea567e44b6070591f96b9385beccc9e29d745026eca3c1
SHA3-384 hash:	ad31c76116ded8934328fb7df21d816716fd78e080d53b497329536cfb526a8b6563c57aefefbe043a5719e8a3da0568
SHA1 hash:	6bccea7fd29074d2939d3f68146f7b539d1d5336
MD5 hash:	3207964c1b09599b0bfd734d4d30533e
humanhash:	avocado-queen-pennsylvania-whiskey
File name:	3207964c1b09599b0bfd734d4d30533e
Download:	download sample
Signature	Loki Create hunting rule
File size:	1'033'216 bytes
First seen:	2022-10-31 14:46:39 UTC
Last seen:	2022-10-31 17:15:21 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:S4EglPGzZHLHHqDKuzqV2hCpZkiLpO1eHu6n0oHLU/UhMIDDo3:eIuzZWBO8sO1eYEY/U6WM
Threatray	13'108 similar samples on MalwareBazaar
TLSH	T18825BE511B80C50EE2962E36A892C3F09BE8CD50AD5DF2876BE47F1BB4B7DE7D560240
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter	zbetcheckin
Tags:	32 exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

472

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

lokibot

ID:

File name:

3207964c1b09599b0bfd734d4d30533e

Verdict:

Malicious activity

Analysis date:

2022-10-31 14:47:15 UTC

Tags:

trojan lokibot

Link:

https://app.any.run/tasks/a939868e-7b62-45da-9b2b-a582fcc4d82b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

LokiBot

Link:

https://www.capesandbox.com/analysis/326459/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.389.5900.31658.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Unauthorized injection to a recently created process

Creating a file

Сreating synchronization primitives

Reading critical registry keys

Changing a file

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for analyzed file

Stealing user critical data

Moving of the original file

Sending an HTTP POST request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/635fdfe7a5db8d309cbc0b1a/reports/6f2c01e3-e517-43c4-ac29-12829a40b992/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fcbf4225-a9e8-4f4a-afc1-55444422be8d

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1101763

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d487bf902cec912284ea567e44b6070591f96b9385beccc9e29d745026eca3c1/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-10-31 11:18:57 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 26 (73.08%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2sd37ebm5sisfbhkkz7ejnqhawi7s24tqw7mzspctv2fajxmupaq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Loki

27e73b1508f3d4e114390a25e11c201bfa2a66d8cab4e385d9bce54fc2df206f

Loki

4e12ca0674f72503e00f35b8b27aa98da0855baa9e25264b357bb934e31a2217

Loki

7f0fcb4f3651ec6a3b273322857afe8aa8373f77964afd0bb592378a4a97fe1a

Loki

+ 13'098 additional samples on MalwareBazaar

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/221031-r5vm5scaep/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://171.22.30.164/kelly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

15d73a776fe344c81d89f8c1403a88694e798a4698997b7e71ff8cd285043e5e

MD5 hash:

30f4d7c4a68786ee7add65357696b171

SHA1 hash:

f1dc5ea4551456140bda5f1be92ea156260cab2f

Link:

https://www.unpac.me/results/48551aa2-d215-4a9c-8cf8-476f888ec1ec/

SH256 hash:

7ba7b5a35d8870e9ab0cd53c3cfbab15b32bd018defc1ef32593823960395f6c

MD5 hash:

ed1a526adf34f2ed909791f847ba5a8d

SHA1 hash:

cae2b53cad630043c50e2a1bac9755aa0c1b7ef9

Detections:

lokibot

win_lokipws_auto

win_lokipws_g0

Link:

https://www.unpac.me/results/48551aa2-d215-4a9c-8cf8-476f888ec1ec/

Parent samples :

dbaf6b7b3a59ffcc8cee70bea12b6587a8ab8dc6555c0d3687f90bda81ed497f
d487bf902cec912284ea567e44b6070591f96b9385beccc9e29d745026eca3c1
a276bad5addfffd45b7d075cc251bf4503db389cec1671ef1e2ab48cef66579f
69287134cfdb64f5560f8647c9fbb742b70f5b681e331aadb552d2cb26893ba0
d67c3acb3dcc0cc6e02616d47e310b44f759a9bf694c72f8fe93dc5428034ce7
7859a51adc3e36b592d77875091d0b044e05ef27c48131f507eb9b7b32716a00
7853266273121287cf3d28f06acf4ee31e45c96f79aa579be493aa086300b6e7
d10b38c3f8fca46c0aba17adb7e513cd28eb277faf3517a0f61c82f222258ce5
2550002ab980043e574d7da8c1276f042313f872f042874fa7c1cc06b5b3b8b6
8325e49180840f7c62839f6dcccc78ff1236fb5262811e019c3cc41de65db0e7
e466f2b15d2b1e07e1bfd641af82e1261d70b92afe9bc656c0e5daa8297bccaf
48474203ae61c55adc1b79d747c7323900246cec6eec74354dee61e378b648ef
22d9d96fe042841c8a547ab29fbd9e9f68104ad166c6add9f4c597d59f2788f8
036d2934741edd1cfac3d1addda35e808ac96b41612e51f504e31113ab249ef3
11680eba11fe74333b1d17eb1b3c488ce0c51ccd7e766b8e204b6eac58314f97
81af61de86ef938368314b6b20c7748ee37cdb092b3fef0e0e134fcdeed748d6
2f94ffede2d8d42125e672769acfde777fecce817bf363b63aaac942002e8afe
9f13fbee557bfe16923893caa81176f959f83ea3eb102af82f99e52da6ea33c2
6de94580f0ba28d95b9a5fb28f54e29343caee1a7999a09ba44d96c0a2906cce
4f3f8153b0841789234621447e7cdf6754b4d8494482853304a849d1ef2c0d89

SH256 hash:

617ca84a6fae0bdbc07e97c274569ee435938ca385eeec07d828beb9349a4680

MD5 hash:

6044fd45ab4720f6b9ecec079a43f4aa

SHA1 hash:

b57bce9a965dcbbd773e64ddb43c815f4b5ec849

Detections:

lokibot

Link:

https://www.unpac.me/results/48551aa2-d215-4a9c-8cf8-476f888ec1ec/

SH256 hash:

f582f972049d89216ca4bd7e4376221c0fb6686aabd3258a5a91c28cd0b7b364

MD5 hash:

fd08aa35480895ff0b3262f36a9c324b

SHA1 hash:

6516cb66f60454b65642da4d00f580818761c489

Link:

https://www.unpac.me/results/48551aa2-d215-4a9c-8cf8-476f888ec1ec/

SH256 hash:

cfc16a2dbb933b1b85807d48966e9301b9fc34f4c44e7357713ca88b54bf4ab4

MD5 hash:

aabd0bdc81026ade6c57383f21d5c227

SHA1 hash:

4b26936bb8c03be6d7963184215a5ab594ecb765

Link:

https://www.unpac.me/results/48551aa2-d215-4a9c-8cf8-476f888ec1ec/

SH256 hash:

d487bf902cec912284ea567e44b6070591f96b9385beccc9e29d745026eca3c1

MD5 hash:

3207964c1b09599b0bfd734d4d30533e

SHA1 hash:

6bccea7fd29074d2939d3f68146f7b539d1d5336

Link:

https://www.unpac.me/results/48551aa2-d215-4a9c-8cf8-476f888ec1ec/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d487bf902cec/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/d487bf902cec912284ea567e44b6070591f96b9385beccc9e29d745026eca3c1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe d487bf902cec912284ea567e44b6070591f96b9385beccc9e29d745026eca3c1

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2259322/

Cape

https://www.capesandbox.com/analysis/326459/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-10-31 14:46:46 UTC

url : hxxp://208.67.105.179/kellyzx.exe