MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f21bd0097650027161d5724a41f4870d403324c5a73128817ef2652c0b9c1fac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f21bd0097650027161d5724a41f4870d403324c5a73128817ef2652c0b9c1fac
SHA3-384 hash: 5d16976dc21d38e40e9c768c13fad6a6bf9b891c288831694aaeb000934c9603322130f70c4608baeb2d76feb279fdab
SHA1 hash: 7ac59b0dea887600cf791721d15be064ec2eecc8
MD5 hash: daaada1d9050881cd8ccd6370f1747be
humanhash: ink-princess-pasta-triple
File name:INV_CG_202003.exe
Download: download sample
Signature Loki
Create hunting rule
File size:325'632 bytes
First seen:2020-07-08 13:45:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4fd7524a853fa06847a229c4ee1aa228 (4 x AgentTesla, 2 x Loki)
ssdeep 6144:lVs1Ua4vI056yLZTVFGKd+d/vWpu8jG/qm92ypuPHS/ObRwI:zbvqyLTFdcd/auGGye2y2HYO9wI
Threatray 1'565 similar samples on MalwareBazaar
TLSH 346412D8D7E08ABAD1085CB3422E1E902714E4540B6D2FA36F91FC5EBC729C69F6D2D4
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Malspam distributing Loki:

HELO: 142-4-22-49.unifiedlayer.com
Sending IP: 142.4.22.49
From: Ashif C.K – Accounts department <info@npfqqtar.com>
Subject: Re: Payment Schedule
Attachment: INV_CG_202003.iso (contains "INV_CG_202003.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/23126/
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Reading critical registry keys
Launching a service
Creating a file
Changing a file
Replacing files
Connection attempt
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Stealing user critical data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f21bd0097650027161d5724a41f4870d403324c5a73128817ef2652c0b9c1fac/
Threat name:
Win32.Trojan.DelfFareIt
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 12:57:03 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6in5aclwkabhcyovojfed5ehbvadgjgfu4ysral66jssyc44d6wa._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
11342707f6d830ff60ffa17dee379e98111383c3ed74ffbeb413a715e3b9675e
Loki
1c462debff42edbdfdab2625c0c349d29da3503fc68453fbd2cc9eb3caccb3fe
Loki
370689025278ad361000a1ad60efb13b4e6af5acc40e667b1db953f1ff911ecc
Loki
57e0b7d2caf9670bb3c1d227152581eb9f9d76a515c0d45654eb210cd795c174
Loki
a8d1421f0d0d3babfd87e46e494a017c2627a20bf67d09b9a0dde3301e5511cf
Loki
c7ed9ceafb18a2851083adb67a9f33e27d35a67cff63b2e08da23f4523a824c7
Loki
ca9f6a11a9200ccde207ba921ae6a6dfef747f88934b90404e779a314ef92ea2
Loki
e4632cb7a8a3bf9d0341219f0fa8562c7baf009b2306b149be7e95ae41027405
Loki
f7595540807945b05a9f17f0281245dab4366844dca5765a5798062027412e03
Loki
fb3583ba6033850a64fa69fe07fd3a04a6555943243452329a65c50c318ed75e
Loki
+ 1'555 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200708-pjscn5jq9j/
Behaviour
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

22a1c22daeae3f1e67e8e85e64cfa145

Loki

Executable exe f21bd0097650027161d5724a41f4870d403324c5a73128817ef2652c0b9c1fac

(this sample)

  
Dropped by
MD5 22a1c22daeae3f1e67e8e85e64cfa145
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/23126/

Comments