MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e47e6723411dc62dcf6e313eaea8678871b21330a18ea4a74dc2bab245239049. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 14

Intelligence 14 IOCs YARA 11 File information Comments 1

SHA256 hash:	e47e6723411dc62dcf6e313eaea8678871b21330a18ea4a74dc2bab245239049
SHA3-384 hash:	700bbd9ac8bdcd1339ac0cabe58ea7493c10982db4dc7ccd148ace96cf478dd86c357508e9f90b2eafb9f03ba9e6867f
SHA1 hash:	3965a353347f262b364ffeb5e225dc9faa60d392
MD5 hash:	90ad6e4926b5dcfb33fe8d58b6551036
humanhash:	jersey-five-social-east
File name:	90ad6e4926b5dcfb33fe8d58b6551036
Download:	download sample
Signature	Loki Create hunting rule
File size:	684'544 bytes
First seen:	2022-02-24 08:35:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep	12288:eMPhIKN0slsw61YW38boDuzLhNI9mOr94yrw0J+kKbZf2bNEJgYYzQ:cKisGw0D3nSNI9794yrvZR9
Threatray	7'964 similar samples on MalwareBazaar
TLSH	T19DE4BE2035AB60CEF063CAFE9DD8FDF1DD6AF53A220E35BA10420F564B49941DE12676
Reporter	zbetcheckin
Tags:	32 exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

191

Origin country :

n/a

Vendor Threat Intelligence

Detection:

LokiBot

Link:

https://www.capesandbox.com/analysis/244145/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Creating a file

Сreating synchronization primitives

Reading critical registry keys

Changing a file

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for analyzed file

Stealing user critical data

Query of malicious DNS domain

Moving of the original file

Sending an HTTP POST request to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/62174381a6f52d32f17f0c66/reports/c74cd4ca-c32b-4d90-bd9f-a162d4ac2b92/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3a3e0a94-9e6b-46d7-8e78-68e8617c4d66

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/945675

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/e47e6723411dc62dcf6e313eaea8678871b21330a18ea4a74dc2bab245239049/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-02-24 06:42:23 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

23 of 28 (82.14%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4r7goi2bdxdc3t3oge7k5kdhrby3eezqughkjj2nyk5lerjdsbeq._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Loki

4dd4e59368f5e310bdebc4f7ee60778446873c9b930f16366592b471a86f3718

Loki

727610ecf5d6c090e8b2ff1ae1198a587429521d215ffefb91069ff2bff72353

Loki

7fe467ef6f392039c0ce5edaadf85c19a8406a0b0b7332131e2b2ddc9f074bb6

Loki

9740fa7b19f17e4c6df857ec1240c243a77ad689894ecaa92bd112709c242664

Loki

bc4e9db6c6cc42bb03d7257abbf2105e1ed6c4fe24ccaabcd3db84fe8a935c1b

Loki

+ 7'954 additional samples on MalwareBazaar

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220224-khly6adffr/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://secure01-redirect.net/gd4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

b205ab4b6c7d0c1d45b6798f37a11d0f26f60727cb9f557477203bcde91a39dd

MD5 hash:

e4cc724b9490edd74ac5f93c268c2b14

SHA1 hash:

9cb5510464c7b788654239cc3d9436c4849ab144

Link:

https://www.unpac.me/results/e08f58cd-79b6-4d23-98cc-77fcc1e4e152/

SH256 hash:

0f36e21e3f3a71eecf144cf8ac51a9652974f9bbf59aa221bb14816ffb66f206

MD5 hash:

06363c8a1790828790bd28d860c3e3d2

SHA1 hash:

7ee70a997cbb6906c9dce7ee2857cb427afad28e

Link:

https://www.unpac.me/results/e08f58cd-79b6-4d23-98cc-77fcc1e4e152/

SH256 hash:

e3bdaf9e98eb65a070cf4424bc123e57ade151c41e4a0d375e769749155c1715

MD5 hash:

78a25e75b94923e889ecd100349facbe

SHA1 hash:

6b3f8db525d3c98f92ed480e664ab8ee9458340b

Link:

https://www.unpac.me/results/e08f58cd-79b6-4d23-98cc-77fcc1e4e152/

SH256 hash:

c56768fe958356dd4bbcfe0658e15305db6977832de975d3bcb140d501545768

MD5 hash:

8acfb55aff2780cfbe31dfbe6b81ff2c

SHA1 hash:

442525da88cabd7c1185af023ed6a83484e2228a

Detections:

win_lokipws_g0

win_lokipws_auto

Link:

https://www.unpac.me/results/e08f58cd-79b6-4d23-98cc-77fcc1e4e152/

Parent samples :

ff305461502bed4b1ad74954c2e2a0d8377b46b7aaa82207a57f7b5163f1b584
739d31a373140799b0dd6caea37b27c35c53e5a40664724753c3824532bbbd82
12f56e0170dd0bd765e935c0709c11a32cf916a9f1f12028e9af123c0a23b8a4
05e9a8f33a8a378d7d2232155b1e41835293f7afcb007d18c9fcc001f61944a9
e47e6723411dc62dcf6e313eaea8678871b21330a18ea4a74dc2bab245239049
dd555b4b4a68ce3505b66201f994671b3887ab2ff4b3278f2098a20d6057c918
dfd1a15b039b2d2769b3e8ef711caa33b1fbc58a75da4c734517b2001a506ca0

SH256 hash:

e47e6723411dc62dcf6e313eaea8678871b21330a18ea4a74dc2bab245239049

MD5 hash:

90ad6e4926b5dcfb33fe8d58b6551036

SHA1 hash:

3965a353347f262b364ffeb5e225dc9faa60d392

Link:

https://www.unpac.me/results/e08f58cd-79b6-4d23-98cc-77fcc1e4e152/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/e47e6723411d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/e47e6723411dc62dcf6e313eaea8678871b21330a18ea4a74dc2bab245239049

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	malware_Lokibot_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe e47e6723411dc62dcf6e313eaea8678871b21330a18ea4a74dc2bab245239049

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2057439/

Cape

https://www.capesandbox.com/analysis/244145/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-02-24 08:35:29 UTC

url : hxxp://104.168.32.66/365cloud/.csrss.exe