MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d79b67e9e7380e870103acd7b29951d0a4cb5f6da18c28a21070463aad65be45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d79b67e9e7380e870103acd7b29951d0a4cb5f6da18c28a21070463aad65be45
SHA3-384 hash: 5307a66ee2d5f0ae85633fa0444f02168d0c63b143f0394c87f4eae043bebceaf39a8d7b2f15f244808869b38c9e5069
SHA1 hash: 81cc021d60a0eccfb8311dbee719a0c7b53bf4ed
MD5 hash: 1026933eb6d82c8758f97f1e73d7d577
humanhash: mountain-stairway-wyoming-dakota
File name:SecuriteInfo.com.Win32.CrypterX-gen.7467.5591
Download: download sample
Signature Loki
Create hunting rule
File size:561'664 bytes
First seen:2023-04-03 04:29:08 UTC
Last seen:2023-04-03 05:58:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:jqitzLwrEPYmKeJMvvrxuoasanTV00vPH:2OWjxuoasc5h
TLSH T162C4128937699D2FCA7E45FED031358503B5942AAB27C3D91CC8A8BD39E3B508146EC7
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:exe Loki

Intelligence

File Origin
# of uploads :
4
# of downloads :
237
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.CrypterX-gen.7467.5591
Verdict:
Malicious activity
Analysis date:
2023-04-03 04:39:32 UTC
Tags:
trojan lokibot
Link:
https://app.any.run/tasks/ba0691cd-77c8-4d1f-91f9-2dadcd23ac47

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/379452/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Win32.CrypterX-gen.7467.5591.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
83%
Tags:
packed
Link:
https://www.filescan.io/uploads/642a564f86877205784f553c/reports/4fa982a8-6755-44a5-aba4-02ddc3621782/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/d79b67e9e7380e870103acd7b29951d0a4cb5f6da18c28a21070463aad65be45
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/29d4c2c7-aa69-4e26-95b5-105c69f93b95
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1206766
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 839681 Sample: SecuriteInfo.com.Win32.Cryp... Startdate: 03/04/2023 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Antivirus detection for URL or domain 2->52 54 7 other signatures 2->54 7 SecuriteInfo.com.Win32.CrypterX-gen.7467.5591.exe 7 2->7         started        11 gjkbpTRqtWXpdd.exe 5 2->11         started        process3 file4 36 C:\Users\user\AppData\...\gjkbpTRqtWXpdd.exe, PE32 7->36 dropped 38 C:\...\gjkbpTRqtWXpdd.exe:Zone.Identifier, ASCII 7->38 dropped 40 C:\Users\user\AppData\Local\...\tmp1788.tmp, XML 7->40 dropped 42 SecuriteInfo.com.W...n.7467.5591.exe.log, CSV 7->42 dropped 56 Tries to steal Mail credentials (via file registry) 7->56 58 Uses schtasks.exe or at.exe to add and modify task schedules 7->58 60 Adds a directory exclusion to Windows Defender 7->60 13 SecuriteInfo.com.Win32.CrypterX-gen.7467.5591.exe 54 7->13         started        17 powershell.exe 21 7->17         started        19 powershell.exe 20 7->19         started        21 schtasks.exe 1 7->21         started        62 Multi AV Scanner detection for dropped file 11->62 64 Machine Learning detection for dropped file 11->64 66 Injects a PE file into a foreign processes 11->66 23 gjkbpTRqtWXpdd.exe 11->23         started        26 schtasks.exe 11->26         started        signatures5 process6 dnsIp7 46 64.227.48.212, 49698, 49699, 49700 DIGITALOCEAN-ASNUS United States 13->46 28 conhost.exe 17->28         started        30 conhost.exe 19->30         started        32 conhost.exe 21->32         started        44 C:\Users\user\AppData\...\B52B3F.exe (copy), PE32 23->44 dropped 68 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 23->68 70 Tries to steal Mail credentials (via file / registry access) 23->70 72 Tries to harvest and steal ftp login credentials 23->72 74 Tries to harvest and steal browser information (history, passwords, etc) 23->74 34 conhost.exe 26->34         started        file8 signatures9 process10
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d79b67e9e7380e870103acd7b29951d0a4cb5f6da18c28a21070463aad65be45/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-04-03 02:03:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=26nwp2phhahioaidvtl3fgkr2csmwx3nuggcriqqobddvllfxzcq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/230403-e4ty1acg35/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://64.227.48.212/?page_id=4983000593629
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
5884cc1f4335076bb2a8c9d14a6d5f00d8bbb70d3caacf30ef4674ab06699fe1
MD5 hash:
9391f97ae9dbcfbfabcd611cd3f8383f
SHA1 hash:
f2941a79606cc652bb8d5b5e5df9a7d84ed6606f
Link:
https://www.unpac.me/results/70ffc087-887d-43c8-9983-45052329f61e/
SH256 hash:
46d66fdef9b251ca2bb602de7f42ff389b159586e47c4f889247a269adf9f8a1
MD5 hash:
188d43ad8dcbbea2c8959791631cde02
SHA1 hash:
7cda3350cbd08e13d22b2301b4b9b3e057f16c74
Link:
https://www.unpac.me/results/70ffc087-887d-43c8-9983-45052329f61e/
SH256 hash:
3c507afadbb1c31a9ebdd24baac5739d47576159e01c5e84f973c951885100aa
MD5 hash:
e79bf0e7e9d52d398e0b23b352394c68
SHA1 hash:
682325763a0ec77e0fd475ea3a4021b4651eceac
Link:
https://www.unpac.me/results/70ffc087-887d-43c8-9983-45052329f61e/
SH256 hash:
69193d4ec928b60a32ed5ee6e8fdab3da230436b8c50062992a7dba0761b4928
MD5 hash:
cf3b94170e79640c8e4f4ff0cf1e11a2
SHA1 hash:
553907b7789a0763e300be6758e47dd1feecce7c
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
Link:
https://www.unpac.me/results/70ffc087-887d-43c8-9983-45052329f61e/
Parent samples :
9379c08a611d759dd3dd8532c51baf927373581ec4ed728e7fe9e418aa297ed2
d79b67e9e7380e870103acd7b29951d0a4cb5f6da18c28a21070463aad65be45
099dfc4278cbcfc8c1e84bd46bde0b5ddbdc86b20d95b8ba6b98b66b4436a345
ad9510ceea49f6f5b37d1310869d7d1d09ce0366833197c55fa83bbfa95d52ee
fe5c1951ae2974e208a94346ba859a9ed7a30393880d4041315f35a3dd90bf38
SH256 hash:
b45ee2df302b59dc44eae361504407f3664b51a12d6a26bb2a4a9f4bfbcd6726
MD5 hash:
49aeb344f878dc01c6e82d3f1747b5f7
SHA1 hash:
47861fc3e3b4b116d0ff3ff8adb0bcf10b143706
Detections:
lokibot
Create hunting rule
Link:
https://www.unpac.me/results/70ffc087-887d-43c8-9983-45052329f61e/
SH256 hash:
d79b67e9e7380e870103acd7b29951d0a4cb5f6da18c28a21070463aad65be45
MD5 hash:
1026933eb6d82c8758f97f1e73d7d577
SHA1 hash:
81cc021d60a0eccfb8311dbee719a0c7b53bf4ed
Link:
https://www.unpac.me/results/70ffc087-887d-43c8-9983-45052329f61e/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d79b67e9e738/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d79b67e9e7380e870103acd7b29951d0a4cb5f6da18c28a21070463aad65be45

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/379452/

Comments