MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea6f6d9fab4b60bafdd8730e249d50c7a1851e4a4dedebc779d266502a0f6ead. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 10


Intelligence 10 IOCs 2 YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea6f6d9fab4b60bafdd8730e249d50c7a1851e4a4dedebc779d266502a0f6ead
SHA3-384 hash: f87c1ccc809e2cf53244fb8c0ebcb899a3e169ec444d85106adcc0e66e85ead7318e18a46f0548bdfe831de842a34c68
SHA1 hash: 9b6a9922c4f1475bf9bf1dd2f71f88905e4a8d90
MD5 hash: e8443af1626f6ccdff4e82cfd293f232
humanhash: fourteen-lamp-yankee-lithium
File name:ProductDetails21638.exe
Download: download sample
Signature Loki
Create hunting rule
File size:1'440'256 bytes
First seen:2022-10-05 06:50:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:xnjoVnNCBllTDonWZQzjFeM6DJOjB9sTTHyaTE78+agEWflDY8xulEV0VrB2dfb1:UNclQnYQb6VOWQ77agEilDrxulEVQkp
TLSH T127653BF4A0BB04E5F80B9DC8697CBDE6427175F38DD80914136DB6048FEBDA96E0858E
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 4d19393907e6c682 (10 x AgentTesla, 2 x a310Logger, 2 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://rze6.sytes.net:4000/is-ready

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://rze6.sytes.net:4000/is-ready https://threatfox.abuse.ch/ioc/870781/
45.155.165.70:4000 https://threatfox.abuse.ch/ioc/870782/

Intelligence

File Origin
# of uploads :
1
# of downloads :
298
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/316736/
Detection(s):
SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/633d295749c58ce767c6333d/reports/2f1a9128-39c6-4d6a-9a3c-4a23e635997e/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/549c4f91-3453-41dd-acc3-b09d8f9b6334
Result
Threat name:
Lokibot, WSHRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1083897
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Drops script or batch files to the startup folder
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
Sigma detected: Register Wscript In Run Key
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses known network protocols on non-standard ports
Wscript called in batch mode (surpress errors)
Yara detected aPLib compressed binary
Yara detected Costura Assembly Loader
Yara detected Lokibot
Yara detected WSHRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 716454 Sample: ProductDetails21638.exe Startdate: 05/10/2022 Architecture: WINDOWS Score: 100 56 Sigma detected: Register Wscript In Run Key 2->56 58 Snort IDS alert for network traffic 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 12 other signatures 2->62 7 ProductDetails21638.exe 4 6 2->7         started        11 Utmlnipujo.exe 1 2->11         started        13 wscript.exe 2->13         started        15 2 other processes 2->15 process3 dnsIp4 42 C:\Users\user\AppData\...\Utmlnipujo.exe, PE32 7->42 dropped 44 C:\Users\...\Utmlnipujo.exe:Zone.Identifier, ASCII 7->44 dropped 46 C:\Users\user\AppData\...\Ytdkdurodzdbuild.js, ASCII 7->46 dropped 48 C:\Users\user\...\ProductDetails21638.exe.log, ASCII 7->48 dropped 80 Encrypted powershell cmdline option found 7->80 82 Creates multiple autostart registry keys 7->82 84 Injects a PE file into a foreign processes 7->84 18 wscript.exe 3 3 7->18         started        22 ProductDetails21638.exe 54 7->22         started        25 powershell.exe 16 7->25         started        27 ProductDetails21638.exe 7->27         started        86 Multi AV Scanner detection for dropped file 11->86 88 Machine Learning detection for dropped file 11->88 29 powershell.exe 11->29         started        90 System process connects to network (likely due to code injection or exploit) 13->90 92 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 13->92 52 rze6.sytes.net 15->52 file5 signatures6 process7 dnsIp8 38 C:\Users\user\AppData\...\Ytdkdurodzdbuild.js, ASCII 18->38 dropped 40 C:\Users\user\AppData\...\Ytdkdurodzdbuild.js, ASCII 18->40 dropped 64 Drops script or batch files to the startup folder 18->64 66 Creates multiple autostart registry keys 18->66 68 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 18->68 70 Wscript called in batch mode (surpress errors) 18->70 31 wscript.exe 7 18->31         started        50 rze6.sytes.net 45.155.165.70, 4000, 49701, 49702 AGROSVITUA Russian Federation 22->50 72 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 22->72 74 Tries to steal Mail credentials (via file / registry access) 22->74 76 Tries to harvest and steal ftp login credentials 22->76 78 Tries to harvest and steal browser information (history, passwords, etc) 22->78 34 conhost.exe 25->34         started        36 conhost.exe 29->36         started        file9 signatures10 process11 dnsIp12 54 rze6.sytes.net 31->54
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ea6f6d9fab4b60bafdd8730e249d50c7a1851e4a4dedebc779d266502a0f6ead/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-10-05 04:39:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5jxw3h5ljnqlv7oyomhcjhkqy6qykhskjxw6xr3z2jtfakqpn2wq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Result
Malware family:
wshrat
Create hunting rule
Score:
  10/10
Tags:
family:lokibot family:wshrat collection persistence spyware stealer trojan
Link:
https://tria.ge/reports/221005-hmgtwsdgfr/
Behaviour
Modifies registry class
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Drops startup file
Reads user/profile data of web browsers
Blocklisted process makes network request
Lokibot
WSHRAT
Malware Config
C2 Extraction:
http://45.155.165.70/se8se/pin.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://rze6.sytes.net:4000
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bc4bb3ea-dbb4-438c-bda6-b18858dec7f5
Unpacked files
SH256 hash:
d0a2bd3b94b4e5795b34ebc2769198e0580dfa26ee68332b1a467414fd772734
MD5 hash:
3353ef72ae15e4b877085bfe762ca6b5
SHA1 hash:
6aaee9b6723aa0d95fa1dc7d54251f9f754f27e6
Link:
https://www.unpac.me/results/51a7a40a-3ddb-4b9b-bf85-d712f225f806/
SH256 hash:
0552f332be90646cf0ab6b74bd49070ad72d21f7805baaff2d10789f94839067
MD5 hash:
bb546c955a15662d72e5361900c640ed
SHA1 hash:
1e398ce2b07535d0e94e5cb5d5bba340f05fc40a
Link:
https://www.unpac.me/results/51a7a40a-3ddb-4b9b-bf85-d712f225f806/
SH256 hash:
ea6f6d9fab4b60bafdd8730e249d50c7a1851e4a4dedebc779d266502a0f6ead
MD5 hash:
e8443af1626f6ccdff4e82cfd293f232
SHA1 hash:
9b6a9922c4f1475bf9bf1dd2f71f88905e4a8d90
Link:
https://www.unpac.me/results/51a7a40a-3ddb-4b9b-bf85-d712f225f806/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ea6f6d9fab4b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/ea6f6d9fab4b60bafdd8730e249d50c7a1851e4a4dedebc779d266502a0f6ead

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:LokiBot
Create hunting rule
Author:kevoreilly
Description:LokiBot Payload
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/316736/

Comments