MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db48dc160b1f48b8939b0d49c5f0bee2a28bc3b340cff62cea8da50424e1afea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 10

Intelligence 10 IOCs 1 YARA File information Comments

SHA256 hash:	db48dc160b1f48b8939b0d49c5f0bee2a28bc3b340cff62cea8da50424e1afea
SHA3-384 hash:	0580ed8138c9a5463d4c09a31eecdc9fd235619206f2649b89e0e8bf6e4d612f693147e6c36b0b0a7c828d286fa2518d
SHA1 hash:	cfdacf507d4bf932401642dd7c62d8aae6dc65f3
MD5 hash:	8a8006fefc0565530f63be48c5e24631
humanhash:	rugby-charlie-aspen-fish
File name:	CERERE DE OFERTA 08-12-2021pdf.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	155'648 bytes
First seen:	2021-08-12 09:07:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	59e6745bf35b42f470b21adfbf2b29c4 (5 x Loki)
ssdeep	3072:gxEJpxEqxE2wzwcqvJRFwasAe3crw9xEAxEKxEJ:GEJ7EAE2Uqh0+6EmEgEJ
Threatray	7'700 similar samples on MalwareBazaar
TLSH	T1A3E38D3337D8842AE241CAB040F206E98F18F81B4D495D071F51FB9E68F6D36E9E9796
dhash icon	f8b8b8399993d0f0 (5 x Loki)
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Loki C2:
http://185.227.139.5/sxisodifntose.php/EiwFBzdyqPDUs

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://185.227.139.5/sxisodifntose.php/EiwFBzdyqPDUs	https://threatfox.abuse.ch/ioc/173608/

Intelligence

File Origin

# of uploads :

# of downloads :

142

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

CERERE DE OFERTA 08-12-2021pdf.exe

Verdict:

No threats detected

Analysis date:

2021-08-12 09:09:57 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/61e4cce6-1896-4ade-b42b-93954fbbf321

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/178556/

Detection(s):

SecuriteInfo.com.__vbaHresultCheckObj.1465.25683.UNOFFICIAL

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Unauthorized injection to a recently created process

Moving of the original file

Malware family:

GuLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/04b63e34-5ddd-44c4-b3fb-90952be40c8e

Result

Threat name:

GuLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/831594

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

GuLoader behavior detected

Hides threads from debuggers

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/db48dc160b1f48b8939b0d49c5f0bee2a28bc3b340cff62cea8da50424e1afea/

Threat name:

Win32.Worm.Wbvb

Status:

Malicious

First seen:

2021-08-12 09:08:08 UTC

AV detection:

2 of 47 (4.26%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3nenyfqld5elre43bve4l4f64krixq5tidh7mlhkrwsqijhbv7va._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

cloudeye

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:guloader family:lokibot downloader spyware stealer suricata trojan

Link:

https://tria.ge/reports/210812-anb2rjt4d6/

Behaviour

Modifies system certificate store

Suspicious behavior: MapViewOfSection

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Checks QEMU agent file

Guloader,Cloudeye

Lokibot

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://185.227.139.5/sxisodifntose.php/EiwFBzdyqPDUs
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

49b04162c412105ab0857de16713724cbf3234a0b6ba51f3a5286312633f20c3

MD5 hash:

1f1b425190b2fb0396ad2d538b1060ba

SHA1 hash:

413f98641d46fdcabfcaf64f29495667de6282ea

Link:

https://www.unpac.me/results/6dc45cca-7a83-44b9-b025-a46348fc15ae/

SH256 hash:

db48dc160b1f48b8939b0d49c5f0bee2a28bc3b340cff62cea8da50424e1afea

MD5 hash:

8a8006fefc0565530f63be48c5e24631

SHA1 hash:

cfdacf507d4bf932401642dd7c62d8aae6dc65f3

Link:

https://www.unpac.me/results/6dc45cca-7a83-44b9-b025-a46348fc15ae/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/db48dc160b1f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/db48dc160b1f48b8939b0d49c5f0bee2a28bc3b340cff62cea8da50424e1afea

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/178556/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample