MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6157b6de3c5fa996df4dec819507e7534787878bcace12405b1874d085bb602. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 16

Intelligence 16 IOCs YARA 20 File information Comments

SHA256 hash:	d6157b6de3c5fa996df4dec819507e7534787878bcace12405b1874d085bb602
SHA3-384 hash:	a92b418d5c3037b0effcfa1d08e37024ef79f72c02900cc95449cbe8d061903a3014bc8979d09e12b971573bb330f660
SHA1 hash:	04a3ed73234ae96a22b0cdff379b9d802018c467
MD5 hash:	eb602c683028bec0c77dd980cffb190b
humanhash:	mockingbird-sodium-network-network
File name:	eb602c683028bec0c77dd980cffb190b.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	613'888 bytes
First seen:	2023-08-10 06:19:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:+NaGGGTIYlV2sw2yCR4qW+lhjCvsqwxvbr8KmvUSWL0plz+39fh:6aGxIYlVRwsFFxKcSOqJo9fh
Threatray	303 similar samples on MalwareBazaar
TLSH	T16DD412FCB2D75C30C3AA0A36C76111042375A7EFA5A3E70F150422E35A2ABDA5755BCB
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	e096962b2b9696e8 (16 x AgentTesla, 4 x Formbook, 2 x RemcosRAT)
Reporter	abuse_ch
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

305

Origin country :

Vendor Threat Intelligence

Malware family:

lokibot

ID:

File name:

eb602c683028bec0c77dd980cffb190b.exe

Verdict:

Malicious activity

Analysis date:

2023-08-10 06:22:58 UTC

Tags:

trojan lokibot

Link:

https://app.any.run/tasks/fa0c5b7f-fb2a-43db-9654-498114698db9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/441863/

Detection(s):

Porcupine.Malware.58887.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Restart of the analyzed sample

Enabling the 'hidden' option for analyzed file

Creating a window

Moving of the original file

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/d6157b6de3c5fa996df4dec819507e7534787878bcace12405b1874d085bb602

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3228b5be-5d40-4479-990f-97e0b9151e13

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1289177

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/d6157b6de3c5fa996df4dec819507e7534787878bcace12405b1874d085bb602/

Threat name:

ByteCode-MSIL.Backdoor.NanoCore

Status:

Malicious

First seen:

2023-08-09 20:50:17 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 37 (54.05%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2ykxw3pdyx5js3pu33ebsud6ou2hq6dyxswocjafwgdu2cc3wyba._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

agenttesla

Loki

5b848695348fa9282ea099ab7306f53bb6c49a8ae238f95a870198d9e6abd332

Loki

7d6ab0bfa49a0dd92c4b9edb62de20fe450694bf9b2fdb5cbeec92c6ca137095

Loki

83eb06c7916703b3c45aebfc9606d4e2926d9f14220b3f970b0b4159abefcbdd

Loki

8a410e64e1d936608d81d50f26a188da0640a7bfd67121dbbc4fbf705485ff25

Loki

903e8bc85723320489960259f907195dbc38fe33cd5471b509a4655583dc02e7

Loki

d50ad11cd990b8a013247eaa4f0a7b1b0044720d56ea2c9834d9560d54e90a22

Loki

f7021617f41a370a760b4e9760922f5f7672e162ee56ae862f9da5121e86bd0e

Loki

+ 293 additional samples on MalwareBazaar

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/230810-g3sewscc7s/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://216.128.145.196/~wellseconds/?p=7982
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

504410fd6158a7346f5a2e7b7714203b329d46dab5d129719410d5c325122804

MD5 hash:

74ed681a2d7aed1dae5627d4367474f8

SHA1 hash:

cad2df636d3f0710f69fdb18cbae03a332341dd3

Link:

https://www.unpac.me/results/78debd21-44b8-4c0c-a91f-d21fb475b759/

SH256 hash:

8973ec20883b3d45af6c843de26bd764bb3ca9346ffe2def89942b1a973f16f0

MD5 hash:

67cda3ec4bee9bf8bb35ea857ac9a5d1

SHA1 hash:

6ca5037103de3a0d69b07610cdb9a4f7ed70c643

Link:

https://www.unpac.me/results/78debd21-44b8-4c0c-a91f-d21fb475b759/

SH256 hash:

f321ba23baa406e31da32b6fd14d84c46b17f47d0fe8f6f84d6712a356f424fe

MD5 hash:

68e1c79ae90e8a75f015fe4125ca652e

SHA1 hash:

37447c563208f0a8df595f508d0871590f7d4f78

Link:

https://www.unpac.me/results/78debd21-44b8-4c0c-a91f-d21fb475b759/

SH256 hash:

b3e8bf0f8f762b1425c44d8c15f72a6202f64a5dff86779bb963678bf60f391e

MD5 hash:

d796994fd7d861384419f02744c63625

SHA1 hash:

36741795a091bf1c85a0b7d9dfe1b70267c3957c

Detections:

lokibot

win_lokipws_auto

win_lokipws_g0

Link:

https://www.unpac.me/results/78debd21-44b8-4c0c-a91f-d21fb475b759/

SH256 hash:

d6157b6de3c5fa996df4dec819507e7534787878bcace12405b1874d085bb602

MD5 hash:

eb602c683028bec0c77dd980cffb190b

SHA1 hash:

04a3ed73234ae96a22b0cdff379b9d802018c467

Link:

https://www.unpac.me/results/78debd21-44b8-4c0c-a91f-d21fb475b759/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d6157b6de3c5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/d6157b6de3c5fa996df4dec819507e7534787878bcace12405b1874d085bb602

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	LokiBot Create hunting rule
Author:	kevoreilly
Description:	LokiBot Payload

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	malware_Lokibot_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	Windows_Trojan_Lokibot_0f421617 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Lokibot_1f885282 Create hunting rule
Author:	Elastic Security

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe d6157b6de3c5fa996df4dec819507e7534787878bcace12405b1874d085bb602

(this sample)

Cape

https://www.capesandbox.com/analysis/441863/

URLhaus

https://urlhaus.abuse.ch/url/2702725/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample