MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8d4c4c1dc7afc5e5c7e38188ebd8ccff158201aa195f7c6c5e681fbcbbec7d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	e8d4c4c1dc7afc5e5c7e38188ebd8ccff158201aa195f7c6c5e681fbcbbec7d6
SHA3-384 hash:	ad762d5c9be72eb3fd3009297b99cdb19886296aff1ee029c95f6fd8a4b7f47c3edcabd7637ae17c8ee14f35d34b97c5
SHA1 hash:	92aba72e9bd78af4e5e11ed83d8ce6e19be595b8
MD5 hash:	cfccd7d2d8ca4fd3fefe24828865479f
humanhash:	eleven-king-music-eleven
File name:	PO-10582022.rar
Download:	download sample
Signature	Loki Create hunting rule
File size:	492'025 bytes
First seen:	2022-07-01 07:14:08 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:cuR6zsYp6HyJ8xn9en/JIYrLvEwdvHmtaQwMesm6Tm:cuR6voHgQeBdzhdv5mm6q
TLSH	T160A423A412812317CB73BA711E9B7AABFEEA0076DF1856D3124990E3E7F548D704E09D
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	Loki QUOTATION rar

cocaman

Malicious email (T1566.001)
From: ""Gilles lefrancois" <glefrancois@mv8.fzhiou.cfd>" (likely spoofed)
Received: "from hp0.mv8.fzhiou.cfd (unknown [161.35.188.174]) "
Date: "Thu, 30 Jun 2022 22:02:44 -0700"
Subject: "request for quotation"
Attachment: "PO-10582022.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

157

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL

Gathering data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e8d4c4c1dc7afc5e5c7e38188ebd8ccff158201aa195f7c6c5e681fbcbbec7d6/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-07-01 04:15:27 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 26 (65.38%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5dkmjqo4pl6f4xd6hami5pmmz7yvqia2ugk7prwf42a7xs56y7la._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220701-h28adshdel/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://198.187.30.47/p.php?id=22289002125658625
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e8d4c4c1dc7afc5e5c7e38188ebd8ccff158201aa195f7c6c5e681fbcbbec7d6