MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9caf6704d5037f6a738897160fe43f3b49384174f62b37b68d5b28ce862b0b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 14

Intelligence 14 IOCs YARA 3 File information Comments 1

SHA256 hash:	e9caf6704d5037f6a738897160fe43f3b49384174f62b37b68d5b28ce862b0b4
SHA3-384 hash:	523c26b23b46d206c65b3f9db111325c5852aaec0ac30ea4253cc723866e5b9c8d793271f2ec2c518dd3aa08fa62dc58
SHA1 hash:	a30677d570d3ecd290ab0794e860c59bf85fa4ec
MD5 hash:	495f38b437ff5fc9f49d2d77842fe53b
humanhash:	lima-floor-fruit-august
File name:	495f38b437ff5fc9f49d2d77842fe53b
Download:	download sample
Signature	Loki Create hunting rule
File size:	624'128 bytes
First seen:	2021-09-15 17:11:54 UTC
Last seen:	2021-09-15 17:55:44 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep	12288:qBWHCM2K4CHI/yzQs2TaIpIxi4EiIwxhvBlI:qj3C8MIpIHBI6hJlI
Threatray	4'704 similar samples on MalwareBazaar
TLSH	T12BD4C0382AFA9029F5766FB95AD4B54597BEBE337A03D15E1050338A4A33B40CC9253F
dhash icon	71f0f0f0eccccc71 (10 x AgentTesla, 6 x Formbook, 6 x SnakeKeylogger)
Reporter	zbetcheckin
Tags:	32 exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

495f38b437ff5fc9f49d2d77842fe53b

Verdict:

Malicious activity

Analysis date:

2021-09-15 17:14:03 UTC

Tags:

trojan lokibot stealer

Link:

https://app.any.run/tasks/e46c1abf-1b39-44f4-be38-4ea7d68998bb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/188253/

Detection(s):

SecuriteInfo.com.Trojan.Siggen15.15094.5414.7921.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Creating a file in the %temp% directory

Delayed writing of the file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/61751c9bdb358dd15ed925fe/reports/2858b832-3de8-47c9-b02b-abf31c33c769/overview

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/068e22f4-c69a-4b96-a1fe-082320b10da1

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/851607

Signature

.NET source code contains potential unpacker

.NET source code contains very large strings

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/e9caf6704d5037f6a738897160fe43f3b49384174f62b37b68d5b28ce862b0b4/

Threat name:

ByteCode-MSIL.Trojan.SnakeKeylogger

Status:

Malicious

First seen:

2021-09-15 13:54:28 UTC

AV detection:

11 of 38 (28.95%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5hfpm4cnka37njzyrfywb7sd6o2jhbaxj5rlg63i2wziz2dcwc2a._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/210915-vqtzvabae9/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Lokibot

Malware Config

C2 Extraction:

http://checkvim.com/fd4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

126302074a1807de6f8b677e621560f290830099ea9d2de5f3235abea7cb622f

MD5 hash:

73b43677b07847daca432923a5e72344

SHA1 hash:

c64cc214a535605a12ceb4086cbf5c805efb55a0

Link:

https://www.unpac.me/results/25ca6180-4db0-4db8-9fb9-42adf0b76377/

SH256 hash:

ad4a7895d529d5164302bb88596964ab42ff125bf0f5544418c80b6d438cb587

MD5 hash:

43ababb6b0a02907aad43084f12b10d9

SHA1 hash:

b60ba705891d5a666d64300181b475a46714ffa8

Link:

https://www.unpac.me/results/25ca6180-4db0-4db8-9fb9-42adf0b76377/

SH256 hash:

2cf409f8118930987ab4dd551c491ced6e96387e6a3b82dbfd29c90cad9d541a

MD5 hash:

cc709db3e0b49a140ed475123898f048

SHA1 hash:

46611cf1e99da9b1bb4c08e8bbe44dc012f1dd34

Detections:

win_lokipws_g0

win_lokipws_auto

Link:

https://www.unpac.me/results/25ca6180-4db0-4db8-9fb9-42adf0b76377/

Parent samples :

30cac5dddc6d9c235c35ae552ec995845eb34d82f9fdb74af722f193d8f53fcb
e9caf6704d5037f6a738897160fe43f3b49384174f62b37b68d5b28ce862b0b4
8e8611d4f594d003a87db801b69a0c132114fea33aca39c7fcc8a18cb17d1985
3c7cc3586c0ff5da2f3bd6911717e8a1ce15daa3c1d0e9729fd0bb5b07fe146a
1f0573284ea83d62476e97156074ba2a7a1f046e21cbe82244234725999e1bbf
7532843070bc15b8f344e854f792fd7238819519a9c6bd048030a3575bc2c891
895a3f8a366ed73ca1cab8ef49582ada6382880654ab28e95b2902cde46e3726
711d41ba139f51e91bbb8f691f91e55655a0ad5a40f61a6bfebd9fe3d1ae2e37
61469a1a12ec1dadb9f884a0f07c23d7de89e77cb687bb6919c555de6ca8dc22
4e51be51b27ae05959149ff78aa3ebdf1010ce97def9882590b843816318faa9
5276828cc9b76bee177d1ff0f6fa4209a00f01a7e8aa70561cc520f0adc4d856
4f28f8460abcaaf087c8f7ac3980916768846e60a096763429bc66bed1e62f57
6065a675d7139a622ce9b68fbd2b6909ce47acc09a24afcf697b170b8ed53b3b
a000b23522b61426cc40661c7a0d46b2e897d95c010f9496bbcd848576d64dc2

SH256 hash:

e9caf6704d5037f6a738897160fe43f3b49384174f62b37b68d5b28ce862b0b4

MD5 hash:

495f38b437ff5fc9f49d2d77842fe53b

SHA1 hash:

a30677d570d3ecd290ab0794e860c59bf85fa4ec

Link:

https://www.unpac.me/results/25ca6180-4db0-4db8-9fb9-42adf0b76377/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/e9caf6704d50/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/e9caf6704d5037f6a738897160fe43f3b49384174f62b37b68d5b28ce862b0b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe e9caf6704d5037f6a738897160fe43f3b49384174f62b37b68d5b28ce862b0b4

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1622537/

Cape

https://www.capesandbox.com/analysis/188253/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-09-15 17:11:56 UTC

url : hxxp://103.155.80.150/msn/vbc.exe