MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6c8c3bd1d9b47640af57999739a7a61da9fec6471efbfba7280560a9f57c752. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6c8c3bd1d9b47640af57999739a7a61da9fec6471efbfba7280560a9f57c752
SHA3-384 hash: 948d7f9518ceb2e9d978bd8cffef248fdecdcb3b83e1a816b56aed7284235be39b7acb37055c25981ab997e1b90d7965
SHA1 hash: d9a1cfcfd552e0771619cd60266bcc39b7d4bc87
MD5 hash: acc0e6bdc5eaf1885f843ee8016758a1
humanhash: sierra-victor-green-whiskey
File name:acc0e6bdc5eaf1885f843ee8016758a1
Download: download sample
Signature Loki
Create hunting rule
File size:679'936 bytes
First seen:2021-11-08 09:45:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:arqI5hRmz1+oPf/1yghFh5BhvnYjp5wylG:wF5hRmZ+oPX1ygXh5BhvnYjp5wylG
Threatray 5'360 similar samples on MalwareBazaar
TLSH T121E439059BD44D09C37E03705529A06CDDA14E7B663DC258BF8E36AB2F7BA10866373B
Reporter zbetcheckin
Tags:32 exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/203236/
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6188f1dd2084b424af0f61fb/reports/bde95a34-0bee-4cbf-84ad-6671d014178c/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8b74d86e-768f-42dd-9cac-b58a0cca6886
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/885136
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d6c8c3bd1d9b47640af57999739a7a61da9fec6471efbfba7280560a9f57c752/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-11-08 08:38:16 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=23emhpi5tndwicxvpgmxhgt2mhnj73deohx37otsqblavh2xy5ja._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
137e4162f79a69f28e8bdd4c7f814f82475b864a5cb82c9e4e0b6b38d221920b
Loki
3dd38daa4ca8630ccda829c5d97e744ed278ddbf9c79161450cdb9517c74e027
Loki
7c72d2e12ed2db6353a373d16c07eaf27fbf110c75a2dc7535ec7d624cb42012
Loki
988015476a43d916c6d49009eaa2e262246ac18eaf1615113262cd3540708450
Loki
a358f9eb5bcd5300fa83d2080d4ec9f1996b5fedbc5b6f63a4d95738c8d99704
Loki
a376668a48de6be4c4f85e7abc40fb3806580c2733912c6e400db843e41aa056
Loki
a6dcb375ec518dc845d50e3508c30168f0f12f9e28f221e14734c52fb7f29942
Loki
ab1cef822f66d7b77574a21c8154d4a6e9fcd196a6659637f1d662f0ef7df3bd
Loki
b65b34a54593add5ada0cc781f370a27c19af92ff0f2621b1539efd90a001cde
Loki
fed21233449898cf24af01a24a9e552fa1c3f3684a4cc1411ae9240d1af5991b
Loki
+ 5'350 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/211108-lrmsgsbfg4/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://secure01-redirect.net/ga20/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
91655863c7906a8d20c7c782144f553c027843a72f2fdab2b1ccc80808083af0
MD5 hash:
b5044dd0e9c91b1a9185d491da7d07f2
SHA1 hash:
a9ff8129771d85f77b6a145f750c70e53f51125e
Link:
https://www.unpac.me/results/0d860ac3-880e-4c9e-b89e-75f4f16d1d59/
SH256 hash:
16b53ce2a98aa6bef2085fb9d741972e10e13b660f6e0be227d2ac61aef21c59
MD5 hash:
d73301a56be145f003976d55d68553b9
SHA1 hash:
b8786e343c425086b597d76349fc8d914e8b36e0
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/0d860ac3-880e-4c9e-b89e-75f4f16d1d59/
Parent samples :
2587179c5c51388c763787aaf3449a1c61b710db165a53ffb7510c1eadfebf01
6b52710407ef9ac5e2f4054b1faddb2d3a935f5e8c0ca1ec15a7dcf56aa4368f
99d9efe5477edafdec137e05fac1b92e37a4a2fde0d65d80859fe0fb046620b9
2d25626b7fb64b8d9dede90e95cbd2ee0375b3d0f9e44c95951722f4d193b3af
d6c8c3bd1d9b47640af57999739a7a61da9fec6471efbfba7280560a9f57c752
8143a29c5d36712d3a1e93596b84bd0a4a83c69104ee9dea8f123b965b30091c
SH256 hash:
c75ca8a4bc0b607bda6e5b326b7ea53d2c05f2a47003a774fffc2d33ec4496c0
MD5 hash:
2e48b3197ffd5e2f04e9992874eae5ae
SHA1 hash:
f0898ea240cd96fac4c0da18bd04961107ffe273
Link:
https://www.unpac.me/results/0d860ac3-880e-4c9e-b89e-75f4f16d1d59/
SH256 hash:
d6c8c3bd1d9b47640af57999739a7a61da9fec6471efbfba7280560a9f57c752
MD5 hash:
acc0e6bdc5eaf1885f843ee8016758a1
SHA1 hash:
d9a1cfcfd552e0771619cd60266bcc39b7d4bc87
Link:
https://www.unpac.me/results/0d860ac3-880e-4c9e-b89e-75f4f16d1d59/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/d6c8c3bd1d9b47640af57999739a7a61da9fec6471efbfba7280560a9f57c752

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe d6c8c3bd1d9b47640af57999739a7a61da9fec6471efbfba7280560a9f57c752

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1763362/
Cape
Cape
https://www.capesandbox.com/analysis/203236/

Comments


Avatar
zbet commented on 2021-11-08 09:45:12 UTC

url : hxxp://103.232.53.184/1118/vbc.exe