MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d6edba98646efecccc2f9e35c537d8a08f986bef694efdc8cdc0301f80fba616. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Loki
Vendor detections: 14
| SHA256 hash: | d6edba98646efecccc2f9e35c537d8a08f986bef694efdc8cdc0301f80fba616 |
|---|---|
| SHA3-384 hash: | 5f170ec57d56742aa22d396726087e429403af39250f0c580e902783f37c3330e22b6c950943a25d0cd8d190e346a1e5 |
| SHA1 hash: | 3ea5c54ed5882eb657fe86e4877c8e54063bc7b0 |
| MD5 hash: | fc8f3e9da2f2d9811bb88b5f7ee41dce |
| humanhash: | carolina-seven-maine-utah |
| File name: | Purchase Inquiry Daxparker 03062023 files.exe |
| Download: | download sample |
| Signature | Loki |
| File size: | 902'656 bytes |
| First seen: | 2023-03-06 04:35:25 UTC |
| Last seen: | 2023-03-06 06:37:30 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:OgWAwb3cOQ7IZLYMLDM5fmVyUrQ3/xOyEY3yHwkI+R8EAakuO3S2:EAA3cOQkSM4+VM3/QyaHxI+eEAaOC |
| Threatray | 111 similar samples on MalwareBazaar |
| TLSH | T132155A7371BC90AFF58A003750387B882B3CA453A6D5A20776F6758C95C18BAFE94ED1 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 6cd0d0ccc4ccf4d4 (1 x Loki) |
| Reporter |  abuse_ch |
| Tags: | exe Loki |
Intelligence
File Origin
# of uploads :
2
# of downloads :
228
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
lokibot
ID:
1
File name:
Purchase Inquiry Daxparker 03062023 files.exe
Verdict:
Malicious activity
Analysis date:
2023-03-06 04:35:54 UTC
Tags:
trojan lokibot
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Launching a process
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
lokibot packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
Lokibot
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Threat name:
Win32.Spyware.Noon
Status:
Malicious
First seen:
2023-03-06 04:40:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
14 of 25 (56.00%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Similar samples:
+ 101 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Score:
10/10
Tags:
family:lokibot collection spyware stealer trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Lokibot
Malware Config
C2 Extraction:
http://68.183.13.128/?page_id=4136377
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
498c0460da26cfc2c4ec95b9b394bbd3db719ba08ccbd5964a533bc9006dcf8f
MD5 hash:
f4e7e91d4fdda2d3feb401b5b1d53abf
SHA1 hash:
cf9e76e6418850ac853bd9c6ce82a0be7920fc1d
SH256 hash:
36327d9a70459c61240d719f852c8d4c3eafe8c2abf4891a5646e4cedd41b03a
MD5 hash:
fca8eaa0d10ae39d32e74a03a40152b3
SHA1 hash:
b19ea1758a47910a1c4a0c2d99dee13d65183447
SH256 hash:
d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37
MD5 hash:
0fb6061f7d37424fb9e6d0e76b019c19
SHA1 hash:
98a64bf7b459f032d6ec5793003bf61b5ae1dd74
SH256 hash:
ad2a36f03c2ae5ebcb42d293eff48e34b17e6594d13c359c93621f754cb9ae70
MD5 hash:
0ed86064346b6dc5140b44e69a499c71
SHA1 hash:
5e4417d338d6604dcceb7bb3413c1aa149aba794
Detections:
lokibot
SH256 hash:
11d023325f99b8ea727359780bb58d68bdd5b948ca2ba3e9fc13b36ab2fb005c
MD5 hash:
a53c9a40bca8d343700294aaba3b9978
SHA1 hash:
3dcfd33aa1ea390079dc91ed52c640f4e7149cd9
Detections:
lokibot
win_lokipws_auto
win_lokipws_g0
SH256 hash:
d6edba98646efecccc2f9e35c537d8a08f986bef694efdc8cdc0301f80fba616
MD5 hash:
fc8f3e9da2f2d9811bb88b5f7ee41dce
SHA1 hash:
3ea5c54ed5882eb657fe86e4877c8e54063bc7b0
Malware family:
Lokibot
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.