MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcbcaf3bd263e87cfa4c5355c0c3236552bef553cd9fd4bec8e57200b71a23a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	dcbcaf3bd263e87cfa4c5355c0c3236552bef553cd9fd4bec8e57200b71a23a4
SHA3-384 hash:	bf0f16933ecb1158e851f4747f3259736c7dda30a99a69248ef6a7416f291bbcea10ee033b3574fa84123854ed9c5c1c
SHA1 hash:	c2b8a66d2045db1181a9461f19a80f9c89b4e30d
MD5 hash:	c69e7e09d13074593fba7966e5769210
humanhash:	speaker-william-king-lake
File name:	PO.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	975'360 bytes
First seen:	2020-10-08 13:13:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	24576:20QS2FVj+PDKNuWPNb1waPkNo0lbdjgjp8sqW1X:2S4CmAWPT+bdE18dW1
Threatray	508 similar samples on MalwareBazaar
TLSH	7F25DF297B969B8FC62D4E7A841784209BF0C563A207F7CB3DD729E84D5E7C84E21253
Reporter	abuse_ch
Tags:	exe geo KOR Loki

abuse_ch

Malspam distributing unidentified malware:

HELO: mail-smail-vm48.hanmail.net
Sending IP: 203.133.180.236
From: 김승준 <woritec@hanmail.net>
Subject: 발주서송부드립니다.
Attachment: 발주서송부드립니다.cab (contains "PO.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Loki

Link:

https://www.capesandbox.com/analysis/69257/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Creating a file

Enabling autorun by creating a file

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/485498

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM_3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/dcbcaf3bd263e87cfa4c5355c0c3236552bef553cd9fd4bec8e57200b71a23a4/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-10-08 04:35:50 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3s6k6o6smpuhz6smknk4bqzdmvjl55ktzwp5jpwi4vzabny2eosa._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

spyware trojan stealer family:lokibot

Link:

https://tria.ge/reports/201008-ckxnk6hzr6/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://79.124.8.8/plesk-site-preview/benetaeu-group.com/http/79.124.8.8/ekene/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php