MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9391830030c6666a3b751f4e54b786ae80b901a25eadb07c4dd671b1e791838. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	e9391830030c6666a3b751f4e54b786ae80b901a25eadb07c4dd671b1e791838
SHA3-384 hash:	883f438dcc194f5b309d8c63d42a3925fafa51546f474c79bfd90cd34ecfb2f57d08e265ca8c474eec5c8a922fddf2c0
SHA1 hash:	f938432934c7b8ef2466de155e1513377168d147
MD5 hash:	267e88a12fc876fa1cef6746c27e7ab3
humanhash:	winter-august-lion-carpet
File name:	PO.gz
Download:	download sample
Signature	Loki Create hunting rule
File size:	530'989 bytes
First seen:	2022-05-06 05:09:22 UTC
Last seen:	Never
File type:	gz
MIME type:	application/x-rar
ssdeep	12288:vDh+GFgHM9t+Fw18u4yMb4bzlReNBXZfMVpkfD:17gOtoR4DgBpfEpq
TLSH	T1B9B423576561DAFAA8019F327215E2C50FD804B9EDB248683F855A3FE24DC792F206F3
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	gz Loki

cocaman

Malicious email (T1566.001)
From: "Jimmy Vong | Deputy Sales Manager <sales9@mekseaconnection.com >" (likely spoofed)
Received: "from mekseaconnection.com (unknown [109.70.144.78]) "
Date: "5 May 2022 13:45:53 -0700"
Subject: "Re: PO "
Attachment: "PO.gz"

Intelligence

File Origin

# of uploads :

# of downloads :

196

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.48988522.3745.17098.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware obfuscated packed

Link:

https://www.filescan.io/uploads/6274adad4b517e213c1f26f4/reports/8faad656-edb9-4c6a-8ad0-5785c301f3be/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e9391830030c6666a3b751f4e54b786ae80b901a25eadb07c4dd671b1e791838/

Threat name:

ByteCode-MSIL.Backdoor.NetWiredRc

Status:

Malicious

First seen:

2022-05-05 12:25:17 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 37 (45.95%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5e4rqmadbrtgni5xkh2oks3ynluaxea2exvnwb6e3vtrwhtzda4a._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220506-ftprzahcc9/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Fake 404 Response

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://45.133.1.45/me/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e9391830030c6666a3b751f4e54b786ae80b901a25eadb07c4dd671b1e791838