MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2b42eb3928d053d687ed2b8e81948972ba452d2e5eac013a32f55a71e1ff2b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 13


Intelligence 13 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2b42eb3928d053d687ed2b8e81948972ba452d2e5eac013a32f55a71e1ff2b9
SHA3-384 hash: 968429de48384c53e23330e2e4a78aa6da5fd53e21baf1ad399f0315998a4deb9dbfa3e0cd9460bb793800b5ce674b67
SHA1 hash: db3ef175f613b38060325a2a2b9dddb874d12cc5
MD5 hash: dd91cd990d994820687d6a1148a054cb
humanhash: yankee-gee-stairway-don
File name:dd91cd990d994820687d6a1148a054cb.exe
Download: download sample
Signature Loki
Create hunting rule
File size:434'688 bytes
First seen:2020-12-09 10:08:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'207 x SnakeKeylogger)
ssdeep 12288:kjes+1090skrFRg4s7hLdheDbEm7br0c:df/URqbxPIc
Threatray 2'117 similar samples on MalwareBazaar
TLSH 6094D03122157B66EA7E0BF5E01034404F785F276631E64EADC260DA31BF734BA91EA7
Reporter abuse_ch
Tags:exe Loki


Avatar
abuse_ch
Loki C2:
http://begadi.ga/clue/gate.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
dd91cd990d994820687d6a1148a054cb.exe
Verdict:
Malicious activity
Analysis date:
2020-12-09 10:15:29 UTC
Tags:
trojan lokibot
Link:
https://app.any.run/tasks/415ed26f-d4db-47c9-8444-e7fcf27c05df

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Loki
Create hunting rule
Link:
https://www.capesandbox.com/analysis/107396/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.29660.21793.32280.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Reading critical registry keys
Creating a file
Changing a file
Replacing files
DNS request
Creating a file in the %AppData% subdirectories
Deleting a recently created file
Stealing user critical data
Connection attempt to an infection source
Moving of the original file
Sending an HTTP POST request to an infection source
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/558806
Signature
.NET source code contains potential unpacker
Found C&C like URL pattern
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM_3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f2b42eb3928d053d687ed2b8e81948972ba452d2e5eac013a32f55a71e1ff2b9/
Threat name:
ByteCode-MSIL.Trojan.Malrep
Create hunting rule
Status:
Suspicious
First seen:
2020-12-09 10:09:05 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6k2c5m4sruct22d62k4oqgkis4v2iuws4xvmae5df5k2ohq76k4q._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
22dcfba741c1520791b89cc96a2b81c32b125d3035c8da71cf956c07aceee138
Loki
3b9ff29f35dafcb9a28349285b3a4f834c21d3a4061f05c775ee53b11fdd6a05
Loki
6490275833a54ddb21377ef003cacd595697c7659c1b7c6fc24a285fec1946ee
Loki
67022a9257f711a8c6287fd668c24d8ded9cefbbe1b0e5cf299a1fd9a03fc29f
Loki
6d4d2a2d69e81b0f6b91a437aaf0869956306c347f0b2ed492168f95d6b24d93
Loki
87623678275abae494cc6b28d4fcdb8e1fd1e016e7abd0e3bfd879a391d77256
Loki
909fbce815ea71ef959b37bb5dc6c18eaea743019b66fae2af196473cffb17b1
Loki
b2a96d57f2421ebdc9fdf4813b413e1d2f84277b5dab59cccc52224094ff5ae4
Loki
f36eeb335a9d18ff16f6b1869f45a0f81d44f93706fd2d39d4568d8d2e694ca3
Loki
f4b7759a1a42ebd89a61ed697ca26661dff56719bbf254b7b1f400f3cf4487d1
Loki
+ 2'107 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot spyware stealer trojan
Link:
https://tria.ge/reports/201209-mpq2ahmwma/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Lokibot
Malware Config
C2 Extraction:
http://begadi.ga/clue/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
c88a66cbf00b12c88e2b970b8bc220e970e8465e56098ced24e97d42be901b94
MD5 hash:
a60401dc02ff4f3250a749965097e13f
SHA1 hash:
3f22d28fd765f831084cb972a8bd071e421c26a1
Link:
https://www.unpac.me/results/a3ac2fcf-ca59-495f-bf39-0415a3d05ef4/
SH256 hash:
a0d5935ddd2a929d726584c2920409e5531bae97c9b5c2eb9ca6a231b73160c3
MD5 hash:
849b3a6681219b21bda8ac06afc79bba
SHA1 hash:
8e1bb93e5a2a9ba811311c4cf50a911ab2cebb7b
Link:
https://www.unpac.me/results/a3ac2fcf-ca59-495f-bf39-0415a3d05ef4/
SH256 hash:
4b97cb9a3f3d26044a22f48acda6422f523db1f25797302e3b6e98b7a2820161
MD5 hash:
13a6ef6795c857d9921dd61cba739321
SHA1 hash:
b212f143238b12e642f2ec4b37811a10049b7663
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/a3ac2fcf-ca59-495f-bf39-0415a3d05ef4/
Parent samples :
f2b42eb3928d053d687ed2b8e81948972ba452d2e5eac013a32f55a71e1ff2b9
4b7f3dd2d5f108a5479549dc729ff56a75edd171899c239b541581edba007d0f
d62ddaa338082bfaaa7ca4806e395729c140bc21737f2d75d779801ce4f900c6
01fef1b53fd76543f5a3b6269a21f4a43db3f5fae33dde27fbcf4782c342b23c
34ca5d588ddc24e821c7ab8e672124ea664309f5c6a6494127cb91dd0e9e1501
9fadf8664cafdac3e46604b3693a4e116f2f65af92fac2ab2c3fde0742f0de99
44e17d3b584375e0b3c9af171ade3ab15155ade34d06a63e2d2f02f725c738f0
8d72963427e5e1ece6579f890111e0b67da9d14bbb60f8cf5f3dbf8d699df48d
SH256 hash:
f2b42eb3928d053d687ed2b8e81948972ba452d2e5eac013a32f55a71e1ff2b9
MD5 hash:
dd91cd990d994820687d6a1148a054cb
SHA1 hash:
db3ef175f613b38060325a2a2b9dddb874d12cc5
Link:
https://www.unpac.me/results/a3ac2fcf-ca59-495f-bf39-0415a3d05ef4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f2b42eb3928d053d687ed2b8e81948972ba452d2e5eac013a32f55a71e1ff2b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_pony
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:Lokibot
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe f2b42eb3928d053d687ed2b8e81948972ba452d2e5eac013a32f55a71e1ff2b9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/898227/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/107396/

Comments