MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea5d5e6f93cfbb2ae2fa24346b05b65e93a6be558040d7d93750f29aa4a51de5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ea5d5e6f93cfbb2ae2fa24346b05b65e93a6be558040d7d93750f29aa4a51de5
SHA3-384 hash:	5b42a4a7dbcaeda5ff96e11eca35b424c1265a49abc3c904b7bdb8e2f8145669d80c19306c0053778d393b8a738a0b08
SHA1 hash:	c4899395782c6b6b3b4c801376e8dca4bae4319f
MD5 hash:	b19ff77ca325b8c110af1f5554d1f45c
humanhash:	football-missouri-bacon-winner
File name:	SecuriteInfo.com.Win32.PWSX-gen.16273.24301
Download:	download sample
Signature	Loki Alert Create hunting rule
File size:	507'392 bytes
First seen:	2023-12-14 03:15:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:RCX0oLt7PNPxw1c0T+dLwlx+H1J3+QvZO1fJ:R9gFN0Tes+H2QRc
Threatray	4'148 similar samples on MalwareBazaar
TLSH	T109B423151629D37BCE9F27FABDA06B8E03B6B2167271C7C9CDE4A1D60143B40E64079B
TrID	63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter	SecuriteInfoCom
Tags:	exe Loki

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

395

Origin country :

FR

Vendor Threat Intelligence

ANY.RUN lokibot

Malware family:

lokibot

Alert

Create hunting rule

ID:

1

File name:

SecuriteInfo.com.Win32.PWSX-gen.16273.24301

Verdict:

Malicious activity

Analysis date:

2023-12-14 03:17:05 UTC

Tags:

trojan lokibot

Link:

https://app.any.run/tasks/3a316553-6844-4a5e-b7c4-7405451aaa4b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox LokiBot

Detection:

LokiBot

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/467350/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.16273.24301.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Сreating synchronization primitives

Reading critical registry keys

Sending a custom TCP request

Changing a file

Sending an HTTP POST request

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for analyzed file

Stealing user critical data

Moving of the original file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

lokibot packed

Link:

https://www.filescan.io/uploads/657a73725937bfdbca1073c1/reports/e1c83470-d3e7-4319-bfa9-7d62d6b061ac/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/ea5d5e6f93cfbb2ae2fa24346b05b65e93a6be558040d7d93750f29aa4a51de5

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Loki

Malware family:

Loki

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3a0e0670-d26a-4ca5-a3e4-c3f4c756902e

Joe Sandbox Lokibot

Result

Threat name:

Lokibot

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1361866

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/ea5d5e6f93cfbb2ae2fa24346b05b65e93a6be558040d7d93750f29aa4a51de5

CERT.PL MWDB lokibot

Detection:

lokibot

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/ea5d5e6f93cfbb2ae2fa24346b05b65e93a6be558040d7d93750f29aa4a51de5/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-14 01:30:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

7

AV detection:

22 of 37 (59.46%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5jov434tz65svyx2eq2gwbnwl2j2npsvqbanpwjxkdzjvjffdxsq._file

Threatray lokipasswordstealer(pws)

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Alert

Create hunting rule

Similar samples:

5c265f863dd66fd970ec22970e360209fd303fc36b7b45eb2d679fa1d2614e9f

Loki

636e1a012f3bd6837ed0267e9dcc1d1dc5fcc939d36e9a2b2d2e292ba17bb2d5

Loki

6ab7f1fe886d5799182d76da3ed259741d9e7dd78773d36b0f4f7e63244b22f4

Loki

+ 4'138 additional samples on MalwareBazaar

Hatching Triage lokibot

Result

Malware family:

lokibot

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/231214-drx98abagq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://178.128.238.137/index.php/25064245498223
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

UnpacMe lokibot win_lokipws_auto win_lokipws_g0 INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Lokibot SUSP_XORed_URL_In_EXE INDICATOR_SUSPICIOUS_Binary_References_Browsers INDICATOR_SUSPICIOUS_GENInfoStealer STEALER_Lokibot

Unpacked files

SH256 hash:

dfd83353eb8f17c8dae6bd56d5d033d417df550816e6102cd87eb1ce563647f8

MD5 hash:

64edb6c656382e4b3cca5ca1eeaefeff

SHA1 hash:

e1e58c222415d2fb02cb932c8590a77b78cf3d13

Link:

https://www.unpac.me/results/090c8212-af0b-48ea-bfef-854f0a620a70/

SH256 hash:

d01f3dea3851602ba5a0586c60430d286adf6fcc7e17aab080601a66630606e5

MD5 hash:

579197d4f760148a9482d1ebde113259

SHA1 hash:

cf6924eb360c7e5a117323bebcb6ee02d2aec86d

Link:

https://www.unpac.me/results/090c8212-af0b-48ea-bfef-854f0a620a70/

SH256 hash:

c5328f7af843244b56d6a208c322a9315daea139d1b255cda993b243e4394ecf

MD5 hash:

160f4669c06c6496d79a92ea9d33e89b

SHA1 hash:

baae226fdb2a9739f118db781bdc74f2efc6a585

Link:

https://www.unpac.me/results/090c8212-af0b-48ea-bfef-854f0a620a70/

SH256 hash:

b03708c04e619602338862df427154899140a05c66ad15b6549619797524c52b

MD5 hash:

ba4b490bccbf0364d8760fe12412db10

SHA1 hash:

2383be0efe2a1a1ce348a594dac5d0101d79e511

Detections:

lokibot

Alert

Create hunting rule

win_lokipws_auto

Alert

Create hunting rule

win_lokipws_g0

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Alert

Create hunting rule

Lokibot

Alert

Create hunting rule

SUSP_XORed_URL_In_EXE

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_Binary_References_Browsers

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_GENInfoStealer

Alert

Create hunting rule

STEALER_Lokibot

Alert

Create hunting rule

Link:

https://www.unpac.me/results/090c8212-af0b-48ea-bfef-854f0a620a70/

Parent samples :

d42c0f3feb463d2bc5899d453f2c5cc05efc8c4a63dff73982e0d0447f41a4b0
c08e53e8609b839287be32c0f5a60b84f6bf49b92ab4be44ca81f5c5dd836cd8
43194a603898e86d15bd6806fb7774ca6049263741ffba630cbfd4f8ae2fdcd1
ea5d5e6f93cfbb2ae2fa24346b05b65e93a6be558040d7d93750f29aa4a51de5
a2e10236dab3013a041ead462b2b280af3f4e9f96a3ca878579dce7d8fef23ec
e0f45f991af19ad7da6f4ddc80f9979dc5c3cf1b6e8166194727dcedba58a8a5

SH256 hash:

ea5d5e6f93cfbb2ae2fa24346b05b65e93a6be558040d7d93750f29aa4a51de5

MD5 hash:

b19ff77ca325b8c110af1f5554d1f45c

SHA1 hash:

c4899395782c6b6b3b4c801376e8dca4bae4319f

Link:

https://www.unpac.me/results/090c8212-af0b-48ea-bfef-854f0a620a70/

VMRay Lokibot

Malware family:

Lokibot

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ea5d5e6f93cf/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Lokibot

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/ea5d5e6f93cfbb2ae2fa24346b05b65e93a6be558040d7d93750f29aa4a51de5

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/467350/