MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d7b7ea1e24d4a72a17eebddcd34a189a40c8a75a4e427e57055584ad960b2eda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Loki
Vendor detections: 13
| SHA256 hash: | d7b7ea1e24d4a72a17eebddcd34a189a40c8a75a4e427e57055584ad960b2eda |
|---|---|
| SHA3-384 hash: | aac4cf435e4a981b14818c441af5fa30d884bc3f45512af56a431d85b7c21e6d9fb49f9017cbbfa65d3454d472afb4b0 |
| SHA1 hash: | 58b17a370f6cdd9292d50932c40f3fd529df2b56 |
| MD5 hash: | c97d380d29b2c25b63e9eb4888c0250b |
| humanhash: | utah-march-friend-bacon |
| File name: | TEU'CV - 1 YEAR TC.xlsx |
| Download: | download sample |
| Signature | Loki |
| File size: | 191'464 bytes |
| First seen: | 2022-02-07 11:07:26 UTC |
| Last seen: | Never |
| File type: |  xlsx |
| MIME type: | application/encrypted |
| ssdeep | 3072:LPIlx5je0E6o7u/YT3E6+V1IeNKfbzwiHWPIGvv0/GdNYAcPkcWxagAt7tPS8U:85Y6o7u/8+68+oIGv82YAIkcWtAtR7U |
| TLSH | T1781412742475BA79F07C2D34D9C702792536AC407E4CDCC4A192B723B636974BE8EE2A |
| Reporter |  abuse_ch |
| Tags: | CVE-2017-11882 Loki VelvetSweatshop xlsx |
Office OLE Information
This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.
OLE dump
| Detection: VelvetSweatshop |
MalwareBazaar was able to identify 6 sections in this file using oledump:
| Section ID | Section size | Section name |
|---|---|---|
| 1 | 64 bytes | DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace |
| 2 | 112 bytes | DataSpaces/DataSpaceMap |
| 3 | 208 bytes | DataSpaces/TransformInfo/StrongEncryptionTransform/Primary |
| 4 | 76 bytes | DataSpaces/Version |
| 5 | 184808 bytes | EncryptedPackage |
| 6 | 224 bytes | EncryptionInfo |
Intelligence
File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
File type:
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
Has a screenshot:
False
Contains macros:
False
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Launching a process
DNS request
Creating a file in the %temp% directory
Creating a file
Сreating synchronization primitives
Reading critical registry keys
Changing an executable file
Changing a file
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Enabling the 'hidden' option for recently created files
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Creating a process from a recently created file
Infecting executable files
Result
Verdict:
Malicious
File Type:
OOXML Excel File with Embedding Objects in Encrypted Excel File
Document image
Image:
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
control.exe embedequation exploit shell32.dll shellcode VelvetSweatshop
Label:
Malicious
Suspicious Score:
9.8/10
Score Malicious:
99%
Score Benign:
1%
Result
Verdict:
MALICIOUS
Link:
Details
Macro Execution Coercion
Detected a document that appears to social engineer the user into activating embedded logic.
Document With No Content
Document contains little or no semantic information.
Result
Threat name:
Lokibot
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Detection:
lokibot
Threat name:
Document-Excel.Exploit.CVE-2017-11882
Status:
Malicious
First seen:
2022-02-07 08:08:22 UTC
File Type:
Document
Extracted files:
51
AV detection:
17 of 28 (60.71%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
lokibot
Score:
10/10
Tags:
family:lokibot collection spyware stealer suricata trojan
Behaviour
Checks processor information in registry
Enumerates system info in registry
Launches Equation Editor
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
NSIS installer
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Loads dropped DLL
Reads user/profile data of web browsers
Uses the VBS compiler for execution
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Lokibot
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Malware Config
C2 Extraction:
http://250b48d798957fbf33b77ae8a74a45ca.ml/Ausin2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Malware family:
Lokibot
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.