MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eccc473ca1398efe9c95c25fba6b3d03d4c959bc27635b5fd252528e1bc5bd6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 15


Intelligence 15 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eccc473ca1398efe9c95c25fba6b3d03d4c959bc27635b5fd252528e1bc5bd6f
SHA3-384 hash: c4c2eb7060843d4aac8f7bdc3ec5f2943478d509c81012a8ec413f8fef88075e75aa309c062139856a1e79a2c55592a9
SHA1 hash: 3404ecb40a143e0f81f04b451986c040c38c0a6d
MD5 hash: 46f0f2e2a3af978862925f33fac17437
humanhash: princess-lithium-red-friend
File name:TUM5653DE463.exe
Download: download sample
Signature Loki
Create hunting rule
File size:793'088 bytes
First seen:2022-10-05 11:00:33 UTC
Last seen:2022-10-05 12:27:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:+/MhzZNcLVMXoLK7XCEkF847XISigtR/4ve:UKmVqEKnd4MSii4ve
Threatray 10'149 similar samples on MalwareBazaar
TLSH T12BF4BD3106E6DA0BD1165334DDE3D3F0AFE85EA5A1B5C2478FE9FC6BF00B0A6A651580
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://162.0.223.13/?08fequikdahgueq78uc

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://162.0.223.13/?08fequikdahgueq78uc https://threatfox.abuse.ch/ioc/870778/

Intelligence

File Origin
# of uploads :
3
# of downloads :
274
Origin country :
n/a
Vendor Threat Intelligence
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/316861/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.21166.25536.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Reading critical registry keys
Changing a file
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/633d63efd089a0c15dd5507a/reports/51bac464-19b6-4383-ab6e-d046863940c8/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3ef7b189-4d85-4a7b-bb02-0928ef95dab4
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1084088
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/eccc473ca1398efe9c95c25fba6b3d03d4c959bc27635b5fd252528e1bc5bd6f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-10-05 11:01:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5tgeopfbhghp5hevyjp3u2z5apkmswn4e5rvwx6skjji4g6fxvxq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
1aebe5d59997e78b81ad714be8dfd697665381018041c62a40a55f0ce215ea35
Loki
3ad292ab37e9e518d9d0ecab0cc469dd9d7fe4f1fc553ffc9eafa9afba79e586
Loki
52431707738f4962e6d465b66c5a8d56d36b0edbcbc268002bc56c6f4b40a4d2
Loki
676ee7a91a1b41c3fa8f2ab8ea445a34f969de6666ef3b0250e4bf72aadc7320
Loki
6bd5bbea9b02d99f157e191dbdfe2d772498c3443496738e2c8d92a9617a099e
Loki
8889a80ba52046a9980a2575191afbf1eed046dccc770acb32542e648e1dd7a1
Loki
9fd17bb86920c52db8ddcbd18efb3725f5570db182676fa678756cc3d3e11c9d
Loki
+ 10'139 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/221005-m4jf9sebc3/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://162.0.223.13/?08fequikdahgueq78uc
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fb3f15f5-f97f-4bde-95f7-2468f9e81340
Unpacked files
SH256 hash:
06fd4ba1e227c6b707d99d06e7486faf1565cbddb0bebad000c656b30da0bb7e
MD5 hash:
718f633b17c69addcb1d7f73250aa0d3
SHA1 hash:
e9cd1f904e59e033b100e8dd68af206254ee6f2b
Detections:
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
Link:
https://www.unpac.me/results/c8c6d07b-21b1-46ea-8b75-f2884b2f2a68/
Parent samples :
eccc473ca1398efe9c95c25fba6b3d03d4c959bc27635b5fd252528e1bc5bd6f
74e53af9391a576f9ab4cc6182f51514946d4e7c41db02ea8927c6f5bb0ca54d
86872882a1df4af709b5a75bade82d33754df38e07fdf50311c93d7b8ca055cc
8ca5ed922f2379f49b055da38fd62566e667300f3031019cfb202eee1efac5b3
SH256 hash:
06af7181a9c9034e69c17e9b7a7f85775bf9a3f3463909735a6855df57658d1a
MD5 hash:
46d526bc3ff1dfbd7144aed269038dbd
SHA1 hash:
a8a6fd439bde8dceda6455bad7b48ab6c80e005d
Link:
https://www.unpac.me/results/c8c6d07b-21b1-46ea-8b75-f2884b2f2a68/
SH256 hash:
5fbdcb76c77563ed3d729fdca3396169c54443253001cf9b1b6b75a0f75cdcb4
MD5 hash:
629c31e71cfa6aab7a62bef45298816c
SHA1 hash:
932da9270d08d3b97ad1fb75e3d3180481f91096
Link:
https://www.unpac.me/results/c8c6d07b-21b1-46ea-8b75-f2884b2f2a68/
SH256 hash:
2303eca31ab288f948795923059e5ffcb38a172e005b7dc7c51b68dd2e2aef21
MD5 hash:
f83827fcd98040a2d6e0780bdc738ea6
SHA1 hash:
6f9877fb091514d5fb71e6e716e6cf5d20e576d6
Link:
https://www.unpac.me/results/c8c6d07b-21b1-46ea-8b75-f2884b2f2a68/
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
Link:
https://www.unpac.me/results/c8c6d07b-21b1-46ea-8b75-f2884b2f2a68/
SH256 hash:
eccc473ca1398efe9c95c25fba6b3d03d4c959bc27635b5fd252528e1bc5bd6f
MD5 hash:
46f0f2e2a3af978862925f33fac17437
SHA1 hash:
3404ecb40a143e0f81f04b451986c040c38c0a6d
Link:
https://www.unpac.me/results/c8c6d07b-21b1-46ea-8b75-f2884b2f2a68/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/eccc473ca139/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eccc473ca1398efe9c95c25fba6b3d03d4c959bc27635b5fd252528e1bc5bd6f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/316861/

Comments