MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f33c5ab923663af6614c346e1691e7cc30f0c2c1afed05efd6f7beacd096a166. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	f33c5ab923663af6614c346e1691e7cc30f0c2c1afed05efd6f7beacd096a166
SHA3-384 hash:	3074cff7e5d4f27070d04c038398fa843e6ecab54da7e8e0466c48d2f614bc1b107c38f9b1fcf0f4c722be2e67904f0d
SHA1 hash:	ca5a82d36e86556c2cab504ce23f6480edb3f36d
MD5 hash:	ad98537a1796949ef413cba82662ae33
humanhash:	orange-tennessee-johnny-potato
File name:	RFQ01072021.iso
Download:	download sample
Signature	Loki Create hunting rule
File size:	1'245'184 bytes
First seen:	2021-07-01 15:08:51 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	12288:ap+yB1EOGQysGIqvRl0DN1+hXfmO81dyZiCgb:aPJGRODWf3
TLSH	58458D312BE94229F0FA9F77C6B3A54057FEF5235F1BD85D385422C90723A42C9B162A
Reporter	cocaman
Tags:	iso Loki

cocaman

Malicious email (T1566.001)
From: "Regional Manager<rst12@dimco.eu>" (likely spoofed)
Received: "from dimco.eu (unknown [103.155.80.90]) "
Date: "1 Jul 2021 08:06:22 -0700"
Subject: "RE_RFQ-2021-QPE-Q63440093-0001_//PICTURES_A-5555-1239_&IMG."
Attachment: "RFQ01072021.iso"

Intelligence

File Origin

# of uploads :

# of downloads :

191

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.899.19005.4974.UNOFFICIAL

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f33c5ab923663af6614c346e1691e7cc30f0c2c1afed05efd6f7beacd096a166/

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2021-07-01 15:09:09 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

10 of 46 (21.74%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6m6fvojdmy5pmykmgrxbnephzqypbqwbv7wql36w667kzuewufta._file

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot spyware stealer trojan

Link:

https://tria.ge/reports/210701-gw9ysn73qn/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Lokibot

Malware Config

C2 Extraction:

http://185.110.190.5/gugufdre.php/auJMYiGBL7JHG
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.54

Link:

https://yomi.yoroi.company/submissions/f33c5ab923663af6614c346e1691e7cc30f0c2c1afed05efd6f7beacd096a166