MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db246897a0efe3c4b3cd4b9f832067815fa920045e9a5a3d0881dc9ffd958fb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db246897a0efe3c4b3cd4b9f832067815fa920045e9a5a3d0881dc9ffd958fb0
SHA3-384 hash: 8dc7967c3c35f6dae07f8bebc1f4115599f5c59a68d1447f5860d8e61c9a897abd3900c956e91a02a0e5c614897d1163
SHA1 hash: 224d3e925800815e792af3a28f8d2dffb9c21e70
MD5 hash: 172da997f8be4c8d0318a322c8ee806e
humanhash: item-violet-kilo-nitrogen
File name:usfive_20210804-112044
Download: download sample
Signature Loki
Create hunting rule
File size:3'072 bytes
First seen:2021-08-04 09:24:07 UTC
Last seen:2021-08-04 10:16:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1009d166426b53e4404dfb0af06622cf (1 x Loki)
ssdeep 48:6FO+WikR5fO5xLzyqq0DikR5fO5hfPla9BS:XiIO5xqqq0DiIO5dla9A
Threatray 3 similar samples on MalwareBazaar
TLSH T14651974B46A98E91EC7D42BD93AF8304AAE55164737424387B6C30AFB1F2D292869343
Reporter benkow_
Tags:exe Loki Lu0Bot

Intelligence

File Origin
# of uploads :
2
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
usfive_20210804-112044
Verdict:
Malicious activity
Analysis date:
2021-08-04 09:27:21 UTC
Tags:
trojan
Link:
https://app.any.run/tasks/46f4c1ac-f4de-4221-9ff8-827a3c07dc8d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Lu0Bot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/176274/
Detection(s):
SecuriteInfo.com.Variant.Zusy.395938.22243.28427.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Creating a window
Connection attempt to an infection source
Sending an HTTP GET request to an infection source
Query of malicious DNS domain
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c592a597-71d6-4d5d-a231-6db902c4674d
Result
Threat name:
Lu0Bot
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/826749
Signature
Downloads files via mshta.exe (likely to bypass HIPS)
Obfuscated command line found
Sigma detected: Mshta JavaScript Execution
Sigma detected: MSHTA Spawning Windows Shell
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Lu0Bot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 459180 Sample: usfive_20210804-112044 Startdate: 04/08/2021 Architecture: WINDOWS Score: 76 52 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->52 54 Yara detected Lu0Bot 2->54 56 Sigma detected: Mshta Spawning Windows Shell 2->56 58 2 other signatures 2->58 10 usfive_20210804-112044.exe 2->10         started        process3 signatures4 62 Downloads files via mshta.exe (likely to bypass HIPS) 10->62 13 mshta.exe 1 10->13         started        process5 dnsIp6 44 asu07.fun 5.188.206.211, 19584, 49709, 49713 KREZ999ASBG Russian Federation 13->44 64 Obfuscated command line found 13->64 17 cmd.exe 4 13->17         started        signatures7 process8 signatures9 50 Obfuscated command line found 17->50 20 cscript.exe 2 17->20         started        23 cscript.exe 2 17->23         started        26 expand.exe 8 17->26         started        29 conhost.exe 17->29         started        process10 dnsIp11 60 Obfuscated command line found 20->60 31 node.exe 3 20->31         started        42 asu07.fun 23->42 38 C:\ProgramData\DNTException\node.exe (copy), PE32 26->38 dropped 40 C:\...\35750f355dabb44295bf4f727f5f9e1e.tmp, PE32 26->40 dropped file12 signatures13 process14 dnsIp15 46 lu0.viewdns.net 31->46 48 asu07.fun 31->48 34 conhost.exe 31->34         started        36 cmd.exe 31->36         started        process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/db246897a0efe3c4b3cd4b9f832067815fa920045e9a5a3d0881dc9ffd958fb0/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-08-04 09:25:05 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
9db5c02ac4e161369160fe13719a212e55377dd57ffc9f98b7141bce3b9df26c
Loki
cb23aeac6382ff99608a71e3b416c1ca22f5f301474840239e4c319db31cef25
Loki
d1d286713588056bdd52865cdd1890ecd13dd44f346adffff875cf74247f1a42
Loki
Result
Malware family:
lu0bot
Create hunting rule
Score:
  10/10
Tags:
family:lu0bot discovery stealer suricata trojan
Link:
https://tria.ge/reports/210804-37mqqeqe3x/
Behaviour
Checks processor information in registry
Enumerates processes with tasklist
Gathers network information
Gathers system information
NTFS ADS
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Drops file in Windows directory
Loads dropped DLL
Modifies file permissions
Blocklisted process makes network request
Executes dropped EXE
Lu0bot
suricata: ET MALWARE lu0bot Loader HTTP Request
suricata: ET MALWARE lu0bot Loader HTTP Response
Unpacked files
SH256 hash:
db246897a0efe3c4b3cd4b9f832067815fa920045e9a5a3d0881dc9ffd958fb0
MD5 hash:
172da997f8be4c8d0318a322c8ee806e
SHA1 hash:
224d3e925800815e792af3a28f8d2dffb9c21e70
Link:
https://www.unpac.me/results/abb08810-e04d-4681-96d5-34b4017513ba/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/db246897a0efe3c4b3cd4b9f832067815fa920045e9a5a3d0881dc9ffd958fb0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://fumik0.com/2021/06/24/lu0bot-an-unknown-nodejs-malware-using-udp/
  
Dropped by
GCleaner
  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/176274/

Comments