MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea3ee3d0360a7d1026af23da26cfee722a22dda0ad90ff647bffd848db7e08e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 11


Intelligence 11 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea3ee3d0360a7d1026af23da26cfee722a22dda0ad90ff647bffd848db7e08e6
SHA3-384 hash: 4aa1207906779a404f5ca74a0ad6ed8f9be3eff800bb438b00827f5b80217af1fa4ad982e40e4e2d32270ddf11a171ee
SHA1 hash: 3c7d00b44e14aea713dd34c8dfbd8c104b97b517
MD5 hash: 500412f15b437a91f4798038cb483cf7
humanhash: queen-angel-stairway-hotel
File name:SecuriteInfo.com.Generic.mg.500412f15b437a91.12345
Download: download sample
Signature Loki
Create hunting rule
File size:904'704 bytes
First seen:2021-02-04 11:43:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:vRMyb2BoEsHFYV4dQKK7v4k0029Hl35OtYQhFxQEAODUP6x6NrSN2eVu6ht+6BDi:yoEslXMhlmHStYaAY6NriVdjN
Threatray 23 similar samples on MalwareBazaar
TLSH C0159D2033419F68E1FD57F7D034000097FA9409DFA6E459ADAA49A4D27BEEDD2E132E
Reporter SecuriteInfoCom
Tags:Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Order Confirmation.xlsx
Verdict:
Malicious activity
Analysis date:
2021-02-04 08:51:56 UTC
Tags:
encrypted opendir exploit CVE-2017-11882 loader
Link:
https://app.any.run/tasks/8849eef7-fd99-40d3-a2a6-eca016d7d077

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/115561/
Detection(s):
SecuriteInfo.com.Generic.mg.500412f15b437a91.12345.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a window
Sending a UDP request
Moving of the original file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/599300
Signature
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ea3ee3d0360a7d1026af23da26cfee722a22dda0ad90ff647bffd848db7e08e6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-04 09:39:21 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5i7ohubwbj6rajvpepncnt7ooivcfxnavwip6zd377merw36bdta._file
Verdict:
unknown
Similar samples:
2038e460115bb3d1729a68364cdb65203692f13abac6666384d1918d5cff9692
Loki
2c835f6d420ccba02279383c7fd61f0b3729c82d0e0b85793426ff9b57b643fd
Loki
57eeb22b59b51f2ebdc14d10502d7b6b7ce20a4c15df666a97d1ba89fb16c3d9
Loki
60a77ee5b32933d4ecd4c6302f62d1ff9ae732b24350c67ac0b6b84f253a867c
Loki
743515ad392665594a63eb8ce2432e2234733685d4d6c275c3d076f8b52182bf
Loki
7aef6a3d7f631fc8fb00123ec3842c3d4e4e6c1c6d81a7a9559832f79cc14c9b
Loki
9b673be5e2878f552738a2fa3c4a776c762e8686a5156be1feeb7b4e947fea2c
Loki
a9a697209f71d50709d9f478079d062b61456682313ed32ff2246c5b57f6264f
Loki
be09092f910db9d06551f0705949487bda9c630e8b3124ef21ec7cb3e3d2bcbb
Loki
c2163712140f5c8fad607b891c31478b96eac087753e4b1022004e0f3a053dcb
Loki
+ 13 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/210204-p4kdwlsbv6/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://becharnise.ir/fa11/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
9c9c543796106e9ee64b593751f7864d4f449086f3daa90145de145901f2c9cd
MD5 hash:
c6deebb3fae943f7e76de874191adfaa
SHA1 hash:
5e2c0707bec8f520ee3e3b7b7e90ef237738696b
Link:
https://www.unpac.me/results/d9c81410-aad3-4977-8c02-5c51c2d0ceb1/
SH256 hash:
c7d3165299526cc6a17ea5ba4908fea209b6c6ae2d5833b81b11688905e3595c
MD5 hash:
f247ce24f06a36718a60e02594ee468b
SHA1 hash:
6f37e50dba90f7190796f3f2d0cd6cd337862f40
Link:
https://www.unpac.me/results/d9c81410-aad3-4977-8c02-5c51c2d0ceb1/
SH256 hash:
a60eaeff6beb61906b607f7a26ed9df7f6043a92a3a9d194cbb62b1c1899231b
MD5 hash:
531a225977914713d649994d2a350297
SHA1 hash:
90ad010a5ad558f7996e8b8d00b3b8ea674b36dc
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/d9c81410-aad3-4977-8c02-5c51c2d0ceb1/
Parent samples :
6ba2fb387dae83da4316cf44ad041851763f9b5e2647ef27a6820c0cf54f8f0b
5b51a354dabc766ae51b1a6af1dc14791d66fd5c20bdfd49b13dd915fc56201d
f82e0beb906a3fe9fb0e76653b60105bbfc9b8515c23d3d3fbd66262cad24b90
5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb
ea3ee3d0360a7d1026af23da26cfee722a22dda0ad90ff647bffd848db7e08e6
62554ddabb1330947f00e029cfa942ad191f30da73a26f0a4a3c4eb5656a8329
89e63255b023d7cace3937516529e78dc8b23500c42ee58e066895347bf4dfee
SH256 hash:
ea3ee3d0360a7d1026af23da26cfee722a22dda0ad90ff647bffd848db7e08e6
MD5 hash:
500412f15b437a91f4798038cb483cf7
SHA1 hash:
3c7d00b44e14aea713dd34c8dfbd8c104b97b517
Link:
https://www.unpac.me/results/d9c81410-aad3-4977-8c02-5c51c2d0ceb1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ea3ee3d0360a7d1026af23da26cfee722a22dda0ad90ff647bffd848db7e08e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe ea3ee3d0360a7d1026af23da26cfee722a22dda0ad90ff647bffd848db7e08e6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/990159/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/115561/

Comments