MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e00ec00017239c89d937e5566508553480539ef0da52fc97441b5c985192c30e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments 1

SHA256 hash:	e00ec00017239c89d937e5566508553480539ef0da52fc97441b5c985192c30e
SHA3-384 hash:	464878bad70aebf4ab83a4de17781d64f93d9acc9ed5733daa756bb1dc050973cbc6dc35cb7c920543c6ff4a51dfbc29
SHA1 hash:	6e786c4cec0bc9b218bdfe10ff6236d824b1fb84
MD5 hash:	cb6521cdaed7288d4d731fdad9bf9365
humanhash:	avocado-fruit-hot-muppet
File name:	cb6521cdaed7288d4d731fdad9bf9365
Download:	download sample
Signature	Loki Create hunting rule
File size:	583'168 bytes
First seen:	2022-11-17 17:19:07 UTC
Last seen:	2022-11-17 17:49:20 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	12288:EF/U/5s5BuvagxG34Hr9zLxJPqHSGFFksebb81GLVScjZnbCkI:H/5+W53xJyHSSs81YVfjZnbCkI
Threatray	13'745 similar samples on MalwareBazaar
TLSH	T17FC418E96893696EE5B9B35D55F1A840CBB388724EC0AE2441783DC19D339D3B122DFC
TrID	61.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.0% (.SCR) Windows screen saver (13097/50/3) 8.8% (.EXE) Win64 Executable (generic) (10523/12/4) 5.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	zbetcheckin
Tags:	32 exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

252

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

lokibot

ID:

File name:

tnymtna.xls

Verdict:

Malicious activity

Analysis date:

2022-11-17 14:54:14 UTC

Tags:

macros opendir exploit cve-2017-11882 loader trojan lokibot

Link:

https://app.any.run/tasks/f25f5fdd-6257-4b62-9a6e-fd6261abe727

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/335501/

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.22946.27461.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

hacktool packed

Link:

https://www.filescan.io/uploads/63766d4307c3f5e84a01a82a/reports/721000f9-f375-49e0-bf5f-f6479c67dc85/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3d073d8e-9741-4411-a5b7-69010cc1cfef

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1115977

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e00ec00017239c89d937e5566508553480539ef0da52fc97441b5c985192c30e/

Threat name:

Win32.Trojan.Taskun

Status:

Malicious

First seen:

2022-11-17 09:57:21 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 26 (69.23%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4ahmaaaxeooitwjx4vlgkccvgsafhhxq3jjpzf2ednojqumsymha._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Loki

4e12ca0674f72503e00f35b8b27aa98da0855baa9e25264b357bb934e31a2217

Loki

7f0fcb4f3651ec6a3b273322857afe8aa8373f77964afd0bb592378a4a97fe1a

Loki

def88fc364ed03678d528bfd6bc39f19ff1831b098aaf0705fa13063c4044a2a

Loki

ec2a93f1858ba7e0de894944d57fb4b2f3021e5574d1b3594bfd8ffe32f7b029

Loki

f998a60cb95f390ca201950cf41b1764646f2f8ca91f13c05fbf78282518e741

Loki

fa4058c30f37d1cdb72e5bbcc467ff8f9b584b090bfdf723ac1f04817980096a

Loki

+ 13'735 additional samples on MalwareBazaar

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/221117-vwer4sfa89/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://sempersim.su/gm10/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/bf5cac79-0a5c-4c27-b338-fe4656efb65b

Unpacked files

SH256 hash:

ecb138edcf3be6525e8336cfc571f01e6f539fc65b3a20f432048e771eb740a7

MD5 hash:

0a83236c510d77795b66bc857828496b

SHA1 hash:

c015d2cf435332b329e0a0c50d8fe360fcf879de

Link:

https://www.unpac.me/results/98ef01b7-8777-4062-a531-abc0b2cee13c/

SH256 hash:

82f45a0bd6e57ad83fa17e3b50cf921834938a9a7bda9511c66b88a76befdd1b

MD5 hash:

5b144fd37c2616647e2de69b360651de

SHA1 hash:

6f57635c653c03251f803df17bc79d106dd944b7

Detections:

lokibot

win_lokipws_auto

win_lokipws_g0

Link:

https://www.unpac.me/results/98ef01b7-8777-4062-a531-abc0b2cee13c/

Parent samples :

e00ec00017239c89d937e5566508553480539ef0da52fc97441b5c985192c30e
1a00fa9d6e02bd8ce2c04443cbbf43119e390f32e1d6986933e9895e8d7ddef8
6b8fbbd7d69b0cb813631af2e75c5d92fd9785e3b22bace1992792b0ee7b37f0
4fc2317b486fba4344c5bf983c138ec30821715652f9b414ccac6c9e262ac831
6bd4365625ded783e8eabc6a1366cdffb975b5a9dc2758ba18bce9a2812f1c8e
6ad914e303ab4e74eada71293402d83756eda6e0556ba0b9e2322c39f82f8a42
c6ee9bf55598a1cd89411602a44fd19e74b78bb02a94b04b7ebe8d69989ffcb3
e8ae9d7ab270771b0aa2fbc378d11920d6804b065daaf25b5be207986b1c85c4
444c1edbdbac15ae07622c50601aedf7c381526fcec95f4f20cc051650905d9b
39d5ed129220b55cc86878b7ed4076407195a7c1e4f0dea37f8985e0444cccd5
3a3a6e12484ba1520ac1bbc3fea93f6208a1758af0cb3f973f64c58f08b3267c

SH256 hash:

cfc16a2dbb933b1b85807d48966e9301b9fc34f4c44e7357713ca88b54bf4ab4

MD5 hash:

aabd0bdc81026ade6c57383f21d5c227

SHA1 hash:

4b26936bb8c03be6d7963184215a5ab594ecb765

Link:

https://www.unpac.me/results/98ef01b7-8777-4062-a531-abc0b2cee13c/

SH256 hash:

d9863c260a36420a4e7fa8357eb5d4f0e2518379180cf3afc842c46694f41d65

MD5 hash:

62194bc0ed569f53fb1dbdd0b8b39fa0

SHA1 hash:

2eea6a9718ea4ef7cd055f5758c5e7b0f908897d

Link:

https://www.unpac.me/results/98ef01b7-8777-4062-a531-abc0b2cee13c/

SH256 hash:

ab19f28c700d64814b0c55df868c30dfb94e0a1f9fb6f7bca05bac6eb78a4e52

MD5 hash:

1f2a6c02dcf9aa00a28a5039fb5b8ce0

SHA1 hash:

1ef480867d39b98368af7586a8e6ba38c0c3893a

Link:

https://www.unpac.me/results/98ef01b7-8777-4062-a531-abc0b2cee13c/

SH256 hash:

e00ec00017239c89d937e5566508553480539ef0da52fc97441b5c985192c30e

MD5 hash:

cb6521cdaed7288d4d731fdad9bf9365

SHA1 hash:

6e786c4cec0bc9b218bdfe10ff6236d824b1fb84

Link:

https://www.unpac.me/results/98ef01b7-8777-4062-a531-abc0b2cee13c/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e00ec0001723/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe e00ec00017239c89d937e5566508553480539ef0da52fc97441b5c985192c30e

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/335501/

URLhaus

https://urlhaus.abuse.ch/url/2422679/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-11-17 17:19:12 UTC

url : hxxp://92.52.217.11/Explorer/csrss.exe