MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebf17062065528a741f635ddbfa773618c23060a96609ce130bddffce137693a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 12

Intelligence 12 IOCs YARA 11 File information Comments 1

SHA256 hash:	ebf17062065528a741f635ddbfa773618c23060a96609ce130bddffce137693a
SHA3-384 hash:	0ac4d93a491c45d9425e228821b36c3cc7c88cc0d51db5d494044c72c5d6dcc1e175a06993538d2f863a0f8a5465ba53
SHA1 hash:	e6d0e4f67a143b0c97aab0c60ce4f8dfe44e2773
MD5 hash:	4d8836e7d058318c9850080d90c650f9
humanhash:	steak-golf-cola-comet
File name:	4d8836e7d058318c9850080d90c650f9
Download:	download sample
Signature	Loki Create hunting rule
File size:	454'656 bytes
First seen:	2022-07-04 09:22:12 UTC
Last seen:	2022-07-04 11:16:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:Hb4e9RO52gUKGevzT2x4qX/m0603Usj6mpUANZ2ae9T7Nst:DKlvz6//m06GUsj6QUEZpS7N
Threatray	11'606 similar samples on MalwareBazaar
TLSH	T11CA4013C77A4A929D8AF07F8945750C48370E06E7A43DF7EDA41A0EA32763729542DB3
TrID	64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.5% (.SCR) Windows screen saver (13101/52/3) 9.2% (.EXE) Win64 Executable (generic) (10523/12/4) 5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	zbetcheckin
Tags:	32 exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

255

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.1414.11555.15361.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Enabling the 'hidden' option for analyzed file

Moving of the original file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/62c2b182783441cda10378d7/reports/d69283f0-c88d-4516-855a-fdf84bb456f7/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6d757357-db1c-496c-802c-198badb93d54

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1024035

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ebf17062065528a741f635ddbfa773618c23060a96609ce130bddffce137693a/

Threat name:

ByteCode-MSIL.Spyware.SnakeLogger

Status:

Malicious

First seen:

2022-07-04 06:57:56 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5pyxayqgkuukoqpwgxo37j3tmggcgbqkszqjzyjqxxp7zyjxne5a._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer suricata trojan

Link:

https://tria.ge/reports/220704-lcfqmaabe3/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

suricata: ET MALWARE LokiBot Checkin

suricata: ET MALWARE LokiBot Fake 404 Response

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

Malware Config

C2 Extraction:

http://185.102.170.20/demo/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

16b9fc4700292684bae0ef2da4a4f4b393103771e93c0b48747df8a24af40d59

MD5 hash:

12ae0e4078e6e9da25181468d72b7ef4

SHA1 hash:

3f88feb096debc12d2f72bac4dfe7e799c7bbf36

Link:

https://www.unpac.me/results/5f058fc4-21fc-411d-8d2a-994f8491f173/

SH256 hash:

1a26dedd258bb5422de9e730d62cd5374247272ddd06921ac58beb5950605692

MD5 hash:

17bc661c1e633381a67b11f053b1c2d3

SHA1 hash:

68603eb3f29167f948bca6d6844686c1b849de8e

Link:

https://www.unpac.me/results/5f058fc4-21fc-411d-8d2a-994f8491f173/

SH256 hash:

b3e5cbb80a19e5bbd5ca27b7e8a9c05b4fd70309b73b54b458e82db2ffc8b865

MD5 hash:

bb1e8bf018379b3f96f122372dcd22f1

SHA1 hash:

93c4543963997415350dda38815ab2e47f6c5693

Detections:

win_lokipws_g0

win_lokipws_auto

lokibot

Link:

https://www.unpac.me/results/5f058fc4-21fc-411d-8d2a-994f8491f173/

Parent samples :

b66327c53adb06f067e45a7763f760aa5a240ec7a8436a0240246ff858c81f5c
1065589a9340762824a0d03fff314f61e65083bf59cbc457e7ebb4986d871611
ebf17062065528a741f635ddbfa773618c23060a96609ce130bddffce137693a
762e0b4b5ac10ebdfa880cdca1989f607cb623a0a58292bd2424314378b04e81
1a63f65bcede3af088e7418ab0ba5a8be2fe254875571e73b32187bb84e4f701
ac6244801e7bc28902f33c0c292da8616933677c58d190ca662f1afc731af60c
ac66eeb17fb8028ffeb839cfa6815679b06ec2bbd6e43e8c3bba052d057ff6be
339977335a0e4a0029c4484e7067b2e1a18f29bcbc27a90b639d6c24daa88803

SH256 hash:

0cb6aef1fa57d11408e47ae071485ef8f48c2982997b8d74b47a4151d85b978c

MD5 hash:

843aa6edf83bff7b61c6a5369ef41e95

SHA1 hash:

d1bfeec8eaac9a1dacf2f7062ce964d8e7d77085

Link:

https://www.unpac.me/results/5f058fc4-21fc-411d-8d2a-994f8491f173/

SH256 hash:

4435fd4f7e6f2afd3ab073e7f0a8e48674c9f2d5a779fc9156e1bf1df47c20f7

MD5 hash:

9a631392dff4685fa671bd8f75e021cc

SHA1 hash:

f62eaa0cfc7cc9f1365094188a06ed017f8402c2

Link:

https://www.unpac.me/results/5f058fc4-21fc-411d-8d2a-994f8491f173/

SH256 hash:

ebf17062065528a741f635ddbfa773618c23060a96609ce130bddffce137693a

MD5 hash:

4d8836e7d058318c9850080d90c650f9

SHA1 hash:

e6d0e4f67a143b0c97aab0c60ce4f8dfe44e2773

Link:

https://www.unpac.me/results/5f058fc4-21fc-411d-8d2a-994f8491f173/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ebf170620655/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	infostealer_loki Create hunting rule

Rule name:	infostealer_xor_patterns Create hunting rule
Author:	jeFF0Falltrades
Description:	The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.

Rule name:	Loki Create hunting rule
Author:	kevoreilly
Description:	Loki Payload

Rule name:	LokiBot Create hunting rule
Author:	kevoreilly
Description:	LokiBot Payload

Rule name:	malware_Lokibot_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Lokibot in memory
Reference:	internal research

Rule name:	MAL_Lokibot_Stealer Create hunting rule
Description:	Detects Lokibot Stealer Variants

Rule name:	STEALER_Lokibot Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect Lokibot stealer

Rule name:	win_lokipws_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe ebf17062065528a741f635ddbfa773618c23060a96609ce130bddffce137693a

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2253696/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-07-04 09:22:15 UTC

url : hxxp://45.153.242.255/250/vbc.exe