MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef25f3865fafd2c357f5a68e0d18ffb0bf5d522675abeef4599c210f9f12a9e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef25f3865fafd2c357f5a68e0d18ffb0bf5d522675abeef4599c210f9f12a9e2
SHA3-384 hash: d58044dafc88b51ff085eae17daa0c7ad64d0167e154b621b958145f24ae8833896ba0376733765d7a005099e8675050
SHA1 hash: 31756b0a0429944a876d8f006d764d43ffdecddf
MD5 hash: e34ccf58b49f343c763a89151f3ab0b1
humanhash: hot-spaghetti-gee-crazy
File name:PO.exe
Download: download sample
Signature Loki
Create hunting rule
File size:865'792 bytes
First seen:2020-10-06 06:05:03 UTC
Last seen:2020-10-06 07:22:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'659 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:jNyAshBNhunrncCUqm2our+4kRjKLxYf/AHPO3+AhQb9o7vjq:jvQhUn3Uqmzu64ACxYsPO/mbk
Threatray 1'552 similar samples on MalwareBazaar
TLSH 4105BF11968C0677F132D038A267D4786BB29D855A08D2D52DE6DCBFFACFE98F4D0248
Reporter abuse_ch
Tags:exe geo KOR Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: relay-005-20.anc24.com
Sending IP: 183.110.224.44
From: 최준호<chprince@ko-woo.com>
Subject: 요청자료목록
Attachment: PO.cab (contains "PO.exe")

Loki C2:
http://79.124.8.8/plesk-site-preview/coautomaquinaria.com/http/79.124.8.8/ekene/Panel/fre.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68438/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Reading critical registry keys
Creating a file
Changing a file
Replacing files
Creating a file in the %AppData% subdirectories
Stealing user critical data
Connection attempt to an infection source
Moving of the original file
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/482373
Signature
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 293627 Sample: PO.exe Startdate: 06/10/2020 Architecture: WINDOWS Score: 100 33 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->33 35 Malicious sample detected (through community Yara rule) 2->35 37 Multi AV Scanner detection for dropped file 2->37 39 10 other signatures 2->39 7 PO.exe 7 2->7         started        process3 file4 23 C:\Users\user\AppData\...\qVuxEZuiAWeIgU.exe, PE32 7->23 dropped 25 C:\...\qVuxEZuiAWeIgU.exe:Zone.Identifier, ASCII 7->25 dropped 27 C:\Users\user\AppData\Local\...\tmp5973.tmp, XML 7->27 dropped 29 C:\Users\user\AppData\Local\...\PO.exe.log, ASCII 7->29 dropped 41 Tries to steal Mail credentials (via file registry) 7->41 43 Injects a PE file into a foreign processes 7->43 11 PO.exe 54 7->11         started        15 schtasks.exe 1 7->15         started        17 PO.exe 7->17         started        19 PO.exe 7->19         started        signatures5 process6 dnsIp7 31 79.124.8.8, 49720, 49721, 49722 HOSTSLICK-GERMANYNL Bulgaria 11->31 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->45 47 Tries to steal Mail credentials (via file access) 11->47 49 Tries to harvest and steal ftp login credentials 11->49 51 Tries to harvest and steal browser information (history, passwords, etc) 11->51 21 conhost.exe 15->21         started        signatures8 process9
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ef25f3865fafd2c357f5a68e0d18ffb0bf5d522675abeef4599c210f9f12a9e2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 02:30:02 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=54s7hbs7v7jmgv7vu2ha2gh7wc7v2urgowv655cztqqq7hysvhra._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
02e8ccb362f76aeb28273e88c3538254effce7f5aa752e17373c1de1c34e3d24
Loki
17347ea4da31247415f8d87423d8b0b03eac3c25c4bed8fac50723eaba2f6b04
Loki
25da7474b9a3f44d1cd3d378bdfde80fc2f6896a38321e1d642d3dccd4f5a010
Loki
441da56bd7e61ce353b6cf4be1510e44983465620fab6130c648bb99e15ab190
Loki
510c68882ff2fed7d2045040f45c79980ebaa58c9c074d59390edc72c1bbca68
Loki
64c4d370517d05b2add478ca85855bf94c4c51ed05e9e02a92afecc04459ea38
Loki
79a794aa53cfb22103d08a8cfa1bb158e2a23bbaa6f73abee590083ae45b560f
Loki
8600c1896f8c6835a9a5c44631ac45b319c0cc9b2e0a50a72bb37436a84ea96a
Loki
986b212acea3c00ed30bba3e1a12519bb601d47f5b0ba61ddb68f5e82eff5d53
Loki
d9c78a21a8344b6cc4768d7fa1b9ff128437267f1b7d1d29fccca4a5751d7ed6
Loki
+ 1'542 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
spyware trojan stealer family:lokibot
Link:
https://tria.ge/reports/201006-rjz44l2xa6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://79.124.8.8/plesk-site-preview/coautomaquinaria.com/http/79.124.8.8/ekene/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
ef25f3865fafd2c357f5a68e0d18ffb0bf5d522675abeef4599c210f9f12a9e2
MD5 hash:
e34ccf58b49f343c763a89151f3ab0b1
SHA1 hash:
31756b0a0429944a876d8f006d764d43ffdecddf
Link:
https://www.unpac.me/results/59122a3b-86ab-41d5-b559-b52073f1cac5/
SH256 hash:
637504848310f205cad5ed99555c84fce3e39e63959797430345a7e94faf8272
MD5 hash:
dc15c7cf000ac372ce7c5ed88f8c045c
SHA1 hash:
10a6a7bb9efb22db1a3e45349f2c3a63552290d0
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/59122a3b-86ab-41d5-b559-b52073f1cac5/
Parent samples :
645c0709512e3abe9794777c7b49ef75ca1b698fbeff13642da042b8c4def95f
ef25f3865fafd2c357f5a68e0d18ffb0bf5d522675abeef4599c210f9f12a9e2
36f84bac671a041b1c04f90d16e70229ba56d8a87d0fa82f2f46a84079edaca7
1957889d188ba3fd7df0ac9e3fe2505d5bd8576865fb96907fc52ad4517db8b1
SH256 hash:
13b24d3a09d099dabe41cd6cd71607a77e14640b1e9b4ed2d60f6c012f191c43
MD5 hash:
109cedae3c384a1913107f1efad2b7c8
SHA1 hash:
1f7f35b0ed85fa12bb839cbce698e59a30813420
Link:
https://www.unpac.me/results/59122a3b-86ab-41d5-b559-b52073f1cac5/
SH256 hash:
ce2ed912793780123e3ee39a48a9af171b24c6fd6830d25cfb84c494263ee9db
MD5 hash:
c8dbaf078122889e6848acc9dd43e998
SHA1 hash:
8d9a9def930fd4f0c8989d46615bce27b204f3bb
Link:
https://www.unpac.me/results/59122a3b-86ab-41d5-b559-b52073f1cac5/
SH256 hash:
324018c8da9204f25652698f8765ec6b3f48e4c34b015e25e7d53f1ea6a6f49b
MD5 hash:
6c5003556f497cc065fe61ae89cab0fa
SHA1 hash:
f0ea17b06bc8ebb3596d799a87e07b58a758a661
Link:
https://www.unpac.me/results/59122a3b-86ab-41d5-b559-b52073f1cac5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/ef25f3865fafd2c357f5a68e0d18ffb0bf5d522675abeef4599c210f9f12a9e2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

cab c28997ac759737f86beb054265c1335d176e38ffb3a30ac3002ceb9fd00ac38c

Loki

Executable exe ef25f3865fafd2c357f5a68e0d18ffb0bf5d522675abeef4599c210f9f12a9e2

(this sample)

  
Dropped by
MD5 82cfd9c90a39dab20a436c60fa94302b
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 c28997ac759737f86beb054265c1335d176e38ffb3a30ac3002ceb9fd00ac38c
Cape
Cape
https://www.capesandbox.com/analysis/68438/

Comments