MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e931e850d015922dd85e504f5013c71def65f29ad1445d5aa69b23de8c05b498. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 13


Intelligence 13 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e931e850d015922dd85e504f5013c71def65f29ad1445d5aa69b23de8c05b498
SHA3-384 hash: 0731a39a2db01303f7326801105404620a08740338e6400b88e9ec832fd1b68bcd7d7903b75b8fdd9a28c941a98cb953
SHA1 hash: ecbe6f5c2de195caf31882eadbf3ee09f3fdde51
MD5 hash: 1d4c617a663a41650e65737db9a3e2c5
humanhash: bravo-ack-kentucky-ink
File name:gunzipped.exe
Download: download sample
Signature Loki
Create hunting rule
File size:331'496 bytes
First seen:2022-08-04 02:10:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (720 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 6144:INeZc5FBkXpIwbmr2KT2BKNyT3q+3V6uIDASUI9mc6:INRTr2KT2JFbOA7f
TLSH T1ED6418C1E599FCD5C438007659B5E521261BAB6EF0B8493B396A7509B0FF383606BE0F
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon d4d0d4ccccdcec34 (4 x Loki, 1 x GuLoader)
Reporter abuse_ch
Tags:exe Loki signed

Code Signing Certificate

Organisation:Blomkaalshovederne Sec
Issuer:Blomkaalshovederne Sec
Algorithm:sha256WithRSAEncryption
Valid from:2022-04-14T14:17:21Z
Valid to:2025-04-13T14:17:21Z
Serial number: 5bf6821ca483d77f
Thumbprint Algorithm:SHA256
Thumbprint: 12384d96752ff3ca224597338d7627c9c67bc30445c5b438e6bcd3e4b6ea4c10
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
Loki C2:
http://s519460.smrtp.ru/Panel/fre.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://s519460.smrtp.ru/Panel/fre.php https://threatfox.abuse.ch/ioc/841339/

Intelligence

File Origin
# of uploads :
1
# of downloads :
382
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
gunzipped.exe
Verdict:
Malicious activity
Analysis date:
2022-08-04 02:11:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9c4909bc-09e5-490c-84a8-613a26a60e91

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/296335/
Detection(s):
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.6896.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %AppData% subdirectories
Delayed reading of the file
Creating a file in the %temp% subdirectories
Searching for the Windows task manager window
Running batch commands
Creating a process with a hidden window
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/62eb2b2e6336465f2a0cf327/reports/cc5fd310-c382-4026-a880-c12d5e52b191/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/105bd021-69a1-4b30-bed9-8f7e7680b077
Result
Threat name:
GuLoader, Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1046023
Signature
C2 URLs / IPs found in malware configuration
Mass process execution to delay analysis
Obfuscated command line found
Snort IDS alert for network traffic
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected GuLoader
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 678517 Sample: gunzipped.exe Startdate: 04/08/2022 Architecture: WINDOWS Score: 100 64 s519460.smrtp.ru 2->64 66 googlehosted.l.googleusercontent.com 2->66 68 2 other IPs or domains 2->68 76 Snort IDS alert for network traffic 2->76 78 Yara detected GuLoader 2->78 80 Yara detected Lokibot 2->80 82 2 other signatures 2->82 10 gunzipped.exe 31 2->10         started        signatures3 process4 file5 60 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 10->60 dropped 62 C:\Users\user\AppData\Local\...\System.dll, PE32 10->62 dropped 84 Obfuscated command line found 10->84 86 Mass process execution to delay analysis 10->86 88 Tries to detect Any.run 10->88 14 gunzipped.exe 21 10->14         started        18 cmd.eXe 10->18         started        20 cmd.eXe 10->20         started        22 62 other processes 10->22 signatures6 process7 dnsIp8 70 drive.google.com 142.250.179.174, 443, 49764 GOOGLEUS United States 14->70 72 googlehosted.l.googleusercontent.com 142.250.74.193, 443, 49765 GOOGLEUS United States 14->72 74 s519460.smrtp.ru 188.127.225.2, 49766, 80 DHUBRU Russian Federation 14->74 90 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->90 92 Tries to steal Mail credentials (via file / registry access) 14->92 94 Tries to harvest and steal ftp login credentials 14->94 96 2 other signatures 14->96 24 WerFault.exe 2 14->24         started        26 Conhost.exe 18->26         started        28 Conhost.exe 18->28         started        30 Conhost.exe 20->30         started        38 2 other processes 20->38 32 Conhost.exe 22->32         started        34 Conhost.exe 22->34         started        36 Conhost.exe 22->36         started        40 47 other processes 22->40 signatures9 process10 process11 42 Conhost.exe 26->42         started        44 Conhost.exe 26->44         started        46 Conhost.exe 32->46         started        48 Conhost.exe 34->48         started        50 Conhost.exe 36->50         started        52 Conhost.exe 40->52         started        54 Conhost.exe 40->54         started        56 Conhost.exe 40->56         started        process12 58 Conhost.exe 42->58         started       
Detection:
guloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e931e850d015922dd85e504f5013c71def65f29ad1445d5aa69b23de8c05b498/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2022-08-04 02:11:06 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ey6qugqcwjc3wc6kbhvae6hdxxwl4u22fcf2wvgtmr55dafwsma._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:lokibot collection downloader spyware stealer trojan
Link:
https://tria.ge/reports/220804-cl9wdsagep/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Legitimate hosting services abused for malware hosting/C2
Checks QEMU agent file
Loads dropped DLL
Reads user/profile data of web browsers
Guloader,Cloudeye
Lokibot
Unpacked files
SH256 hash:
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 hash:
cff85c549d536f651d4fb8387f1976f2
SHA1 hash:
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
Link:
https://www.unpac.me/results/93508901-8122-47f7-b7a8-bb2455637396/
SH256 hash:
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
MD5 hash:
675c4948e1efc929edcabfe67148eddd
SHA1 hash:
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
Link:
https://www.unpac.me/results/93508901-8122-47f7-b7a8-bb2455637396/
SH256 hash:
0b2277d8aaf36e01aca3ae33e227b44bebc541a9c5cef6eb4fef93e96821a6cd
MD5 hash:
b1ba7a8263281244782ca5604876cb2c
SHA1 hash:
b8523dee6d7e74512a05c60cc35c0fddac370252
Link:
https://www.unpac.me/results/93508901-8122-47f7-b7a8-bb2455637396/
SH256 hash:
e931e850d015922dd85e504f5013c71def65f29ad1445d5aa69b23de8c05b498
MD5 hash:
1d4c617a663a41650e65737db9a3e2c5
SHA1 hash:
ecbe6f5c2de195caf31882eadbf3ee09f3fdde51
Link:
https://www.unpac.me/results/93508901-8122-47f7-b7a8-bb2455637396/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e931e850d015/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.98
Link:
https://yomi.yoroi.company/submissions/e931e850d015922dd85e504f5013c71def65f29ad1445d5aa69b23de8c05b498

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/296335/

Comments