MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d499195a574773a1b43a44ce1bbb6ba171da3929c980fc1f8d2ffd020b6ece6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d499195a574773a1b43a44ce1bbb6ba171da3929c980fc1f8d2ffd020b6ece6a
SHA3-384 hash: 567b063a10fcd7122f59283d538bd9c051e21a3a2c6b5315f3ef5404a7ea4933d4a51a06f4752567eeb47a1e82ade655
SHA1 hash: fdda294e0d1286ce1bf5b02ebf067633960466dc
MD5 hash: 2560f211f01a3591687b3ed5ddd47267
humanhash: social-jupiter-bakerloo-nineteen
File name:SecuriteInfo.com.Trojan.GenericKD.44079205.16457.814
Download: download sample
Signature Loki
Create hunting rule
File size:360'960 bytes
First seen:2020-10-15 15:42:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:OuwemNlKUl0sev6H5+Q0JUwJsSyR0ahtIQl/FlD/VOF7sR8X5+IRR:lTbHDdiSG0ahtIQlD/o7XX5N
Threatray 271 similar samples on MalwareBazaar
TLSH F074AE367992DA3FCE6A0736157189CEF67613D62B51870D625E8F8CCE11B6F6303282
Reporter SecuriteInfoCom
Tags:Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/71456/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.44079205.16457.814.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a window
Creating a file
Running batch commands
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/492710
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Creates an autostart registry key pointing to binary in C:\Windows
Drops PE files to the user root directory
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 298819 Sample: SecuriteInfo.com.Trojan.Gen... Startdate: 15/10/2020 Architecture: WINDOWS Score: 72 32 Malicious sample detected (through community Yara rule) 2->32 34 Multi AV Scanner detection for dropped file 2->34 36 Multi AV Scanner detection for submitted file 2->36 38 4 other signatures 2->38 7 SecuriteInfo.com.Trojan.GenericKD.44079205.16457.exe 1 9 2->7         started        11 pcalua.exe 1 1 2->11         started        13 pcalua.exe 1 2->13         started        15 OpenWith.exe 2->15         started        process3 file4 24 C:\Users\user\qgsje, PE32 7->24 dropped 26 SecuriteInfo.com.T...79205.16457.exe.log, ASCII 7->26 dropped 28 C:\Users\user\AppData\Local\Temp\...\Fdf.dll, PE32 7->28 dropped 30 C:\Users\user\AppData\...\AddInProcess32.exe, PE32 7->30 dropped 42 Drops PE files to the user root directory 7->42 44 Tries to detect virtualization through RDTSC time measurements 7->44 17 cmd.exe 1 7->17         started        signatures5 process6 process7 19 reg.exe 1 1 17->19         started        22 conhost.exe 17->22         started        signatures8 40 Creates an autostart registry key pointing to binary in C:\Windows 19->40
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d499195a574773a1b43a44ce1bbb6ba171da3929c980fc1f8d2ffd020b6ece6a/
Threat name:
ByteCode-MSIL.Worm.SpyBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 12:31:22 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0451c23deb9a283b5aead1f5a49d95b09e35c21e953eeeec71ff1d71eaecd9f3
Loki
050daf7c3451797914a6a6a1dc62caf6e739a1177030b91a918b5686df7ec77a
Loki
333a258f45e7a8baaab72b1539859a00bca7309a8d641490329184977090b540
Loki
53a55d9370ca3596d51b4b22a9b1808ed8f60eedf8d11bc8b81b33d068028fad
Loki
5650c4cb25367d0e96c18c28c72460ea457f621840be07fc09dc2b19d05c0b88
Loki
5a92e3b84f322216db9123b7a2bff5b1669d981add700ceb6fb690c8c08ca5bc
Loki
5e5dc622108b69d77e09abf99287d670c8f0249e59971ee49ef7506adb572ecf
Loki
87d8ef6a4c6bf661d7957a62b9e8e9ea6627f80227f9ea88502bf601b94a960e
Loki
9a0f13aaacc9774750adc92ab35b8e9abbc7eeba12b62a3ef3197a88fad675fb
Loki
b76efd5481457c3cc47629fbb3a406b85cbbdf0058b295f918e73c4a0b63ae52
Loki
+ 261 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/201015-edkj61abte/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Adds Run key to start application
Loads dropped DLL
Unpacked files
SH256 hash:
d499195a574773a1b43a44ce1bbb6ba171da3929c980fc1f8d2ffd020b6ece6a
MD5 hash:
2560f211f01a3591687b3ed5ddd47267
SHA1 hash:
fdda294e0d1286ce1bf5b02ebf067633960466dc
Link:
https://www.unpac.me/results/47c01157-1802-48de-ae7d-82651fedd9d9/
SH256 hash:
8b93f42088d21eacafea525802926f2909630db60a3529f972e01e8afbfd4279
MD5 hash:
6d2b6f3578610f94cc0dd507d49180c7
SHA1 hash:
236ad7ed6f07e15eaf3291433ab308014beb053e
Link:
https://www.unpac.me/results/47c01157-1802-48de-ae7d-82651fedd9d9/
SH256 hash:
39c99a9539b034719e14fbc488c2268a2e935dbd0f1162badf898dbdda4eb12d
MD5 hash:
969c10802f9afcd802e938fb49593827
SHA1 hash:
a02f21f1031be8da4bbeb977a0a02a8bb602da40
Link:
https://www.unpac.me/results/47c01157-1802-48de-ae7d-82651fedd9d9/
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Link:
https://www.unpac.me/results/47c01157-1802-48de-ae7d-82651fedd9d9/
Parent samples :
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
69e2ae11e1b5cbe120bf02301191a1cf05e87fc09b09d63bd782abbf3615d05d
0b778873c94f6bc89a40294c0e85a38ab82509260cd2a2e8b73d00c5c90e8757
7ddfa6f44a60f4b894321f6977f8121cfb371c3c61ac872c58ba61fd5ee13deb
SH256 hash:
ddffdabad09267887046450eb399c110de2bbb3e59faa6093fb6f6cb52d892cf
MD5 hash:
5fd0d7e21bb8de0cff133ceae0763ff0
SHA1 hash:
dcbec6bcc86f11af9542cf1610a7b26cf1d2b809
Link:
https://www.unpac.me/results/47c01157-1802-48de-ae7d-82651fedd9d9/
SH256 hash:
8576e2f26371c1022a750729403ec1a04538e332807d47dc6f699c1f4c1a6809
MD5 hash:
7cbec487d53e60f49be3a36c14a9d647
SHA1 hash:
e04ae428314b1015e6686ef61f7a0086fd19dbe6
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/47c01157-1802-48de-ae7d-82651fedd9d9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d499195a574773a1b43a44ce1bbb6ba171da3929c980fc1f8d2ffd020b6ece6a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe d499195a574773a1b43a44ce1bbb6ba171da3929c980fc1f8d2ffd020b6ece6a

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/71456/
  
URLhaus
https://urlhaus.abuse.ch/url/697841/
  
Delivery method
Distributed via web download

Comments