MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6bb29e97cda5ba0698649ddd074d98394fc244e5a6bfbdc8283c7840cd65253. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	e6bb29e97cda5ba0698649ddd074d98394fc244e5a6bfbdc8283c7840cd65253
SHA3-384 hash:	257ee27197d0d36e8319bad5d0e8bd299666cfb58eb97806f34ac3a88551955cb79a4c63d2f6f87cf3e25737b1bedeb3
SHA1 hash:	c5ff93c931036eb56295d270806c2f383946942c
MD5 hash:	cbea7ccf2a580742815b46fa543e8d91
humanhash:	saturn-maryland-berlin-network
File name:	Payment Slip copy.ace
Download:	download sample
Signature	Loki Create hunting rule
File size:	560'648 bytes
First seen:	2022-06-09 13:35:25 UTC
Last seen:	2022-06-10 05:43:52 UTC
File type:	ace
MIME type:	application/x-rar
ssdeep	12288:Eg3GQ1HtRgBmCwezJJE3X7CoKkErMh7Dd/6I9taO9QVvq+7:Eg2WEdwKTE78kErMh96IfaOkvn
TLSH	T11CC42302E6E62A735D6D72D54B0702410D84B41DF6E22FD36C9F5DCC7C22EACA61A8DE
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	ace Loki payment

cocaman

Malicious email (T1566.001)
From: "TaeOan Kim Financial Manager <taeoankim@naver.com>" (likely spoofed)
Received: "from naver.com (unknown [180.214.237.199]) "
Date: "9 Jun 2022 09:15:50 -0700"
Subject: "PAYMENT DETAILS COPY"
Attachment: "Payment Slip copy.ace"

Intelligence

File Origin

# of uploads :

# of downloads :

288

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e6bb29e97cda5ba0698649ddd074d98394fc244e5a6bfbdc8283c7840cd65253/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-06-09 13:36:08 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 26 (65.38%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=425st2l43jn2a2mgjho5a5gzqokpyjcoljv7xxecqpdyidgwkjjq._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220609-qv8lksgehl/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Fake 404 Response

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://sempersim.su/gh8/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e6bb29e97cda5ba0698649ddd074d98394fc244e5a6bfbdc8283c7840cd65253