MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e47e486c7a41e027316eb01cf4b9a93f847933566e84ae178eaa99d5accc4d7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e47e486c7a41e027316eb01cf4b9a93f847933566e84ae178eaa99d5accc4d7e
SHA3-384 hash: 589207e8fae4694d955367c0a90d2e0b8c43d17b2b3147bcccad68e941a73fca731708638fa9343d1f851cfd409d3c6a
SHA1 hash: 8fd515b69405faf1fe7206ef91f6b660a1c3b211
MD5 hash: ca0d509b6ed3098e589ef16fc8e900b1
humanhash: fanta-cola-snake-eight
File name:RFQ-AGS21277_pdf.lzh
Download: download sample
Signature Loki
Create hunting rule
File size:576'389 bytes
First seen:2021-05-08 05:15:16 UTC
Last seen:2021-05-08 07:02:38 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:+9TeCfzfQjxMaxO+MZMPP3P0pOPkYIZn6p6y/GNMLWHujrQGgNIcNRDcxBxSo608:ue44xMP+P30pOPvI4aNMKHujngO+cxBM
TLSH 5BC4239F94D34DD1832A56520C7E0F67060D198372BBE46684E622F6E690BCE7FF40B9
Reporter cocaman
Tags:Loki lzh


Avatar
cocaman
Malicious email (T1566.001)
From: "JENNIFER <Sales@agsflow.com.sg>" (likely spoofed)
Received: "from agsflow.com.sg (unknown [45.137.22.41]) "
Date: "7 May 2021 17:12:39 -0700"
Subject: "RE : RFQ-AGS21277"
Attachment: "RFQ-AGS21277_pdf.lzh"

Intelligence

File Origin
# of uploads :
2
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e47e486c7a41e027316eb01cf4b9a93f847933566e84ae178eaa99d5accc4d7e/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-07 11:25:20 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4r7eq3d2ihqcomlowaopjonjh6chsm2wn2ck4f4ovkm5llgmjv7a._file
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210508-hdwjfr3cw2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://alhajikudi.com/life/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e47e486c7a41e027316eb01cf4b9a93f847933566e84ae178eaa99d5accc4d7e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

rar e47e486c7a41e027316eb01cf4b9a93f847933566e84ae178eaa99d5accc4d7e

(this sample)

Loki

Executable exe deedf8e713b15ff3a42d571076eedafdea6078490412c0ecff44046ef57bd36b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 deedf8e713b15ff3a42d571076eedafdea6078490412c0ecff44046ef57bd36b
  
Dropping
Loki

Comments