MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5ade0a0260b8579ba9359d6e87475ac27c10762e69a3761e2c7d8f30adcc1cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments 1

SHA256 hash:	f5ade0a0260b8579ba9359d6e87475ac27c10762e69a3761e2c7d8f30adcc1cc
SHA3-384 hash:	5c94d6217eb58429fa7be34ad47072a28c17bb3350c96c3323bfaf1dbcca42ecfb5d6745564f8bd7386e0f908903338d
SHA1 hash:	1eb02a941b241aaaf6f2eae57b66b5db3d78ce3b
MD5 hash:	8afe3b53001bfe71592d5a8471694619
humanhash:	sixteen-twenty-oven-stream
File name:	8afe3b53001bfe71592d5a8471694619
Download:	download sample
Signature	Loki Create hunting rule
File size:	308'736 bytes
First seen:	2022-01-18 17:30:55 UTC
Last seen:	2022-01-18 19:29:57 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	6144:QzJbAs6mPb8kX/BUQZVbCvdIq7Jxv0JJfyBmOhpRRRRRERH:QNk6T8A/BUQZV6h7JxMPf/kRRRRRERH
Threatray	6'695 similar samples on MalwareBazaar
TLSH	T1E264025D42AC3577C8FD067CE8B1401893B2C587BB92F3C71F91A95E2E43BD68A12692
Reporter	zbetcheckin
Tags:	32 exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

153

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/220275/

Detection(s):

SecuriteInfo.com.Trojan.Siggen16.35368.15274.18671.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

DNS request

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Creating a file

Сreating synchronization primitives

Reading critical registry keys

Changing a file

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for analyzed file

Stealing user critical data

Query of malicious DNS domain

Moving of the original file

Sending an HTTP POST request to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/61e6f95ad32385db63030238/reports/721f5a14-9f2b-4894-9e74-d65fbde14cf1/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d59f0949-d080-4ee9-a153-891032a38291

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/922673

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/f5ade0a0260b8579ba9359d6e87475ac27c10762e69a3761e2c7d8f30adcc1cc/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-01-18 10:40:58 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

21 of 27 (77.78%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6ww6bibgbocxtoutlhloq5dvvqt4cb3c42ndoypcy7mpgcw4yhga._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Loki

3dd38daa4ca8630ccda829c5d97e744ed278ddbf9c79161450cdb9517c74e027

Loki

7b12e253b0bf89ef0535a8dc539361954c67511bcdbc709060c0b1e6ed539cb6

Loki

895a3f8a366ed73ca1cab8ef49582ada6382880654ab28e95b2902cde46e3726

Loki

a358f9eb5bcd5300fa83d2080d4ec9f1996b5fedbc5b6f63a4d95738c8d99704

Loki

b65b34a54593add5ada0cc781f370a27c19af92ff0f2621b1539efd90a001cde

Loki

c1d9b04bca7264c76a2eae6357f6a2fc931237f374db992a926db9dd714b85c5

Loki

f228ebe1b6d660825c71c76528486d30fe68858362b0bab96a203b4eba670c35

Loki

fed21233449898cf24af01a24a9e552fa1c3f3684a4cc1411ae9240d1af5991b

Loki

+ 6'685 additional samples on MalwareBazaar

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/220118-v3pwnaccb4/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://secure01-redirect.net/gc5/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

4f82fbb51e1e6736adbee01d5e016f6e931273343a4ebbe82f59f04ebf4a7a21

MD5 hash:

250334a00cb1aabd6941bdf986bece2a

SHA1 hash:

d1c9ee0d2858199f4b48a958c4e935cbbf0c021c

Link:

https://www.unpac.me/results/49dba32c-0a85-426e-aad6-00415fee0f02/

SH256 hash:

a45cd2e899401146b032ef202b3ff3bc1dfffa22f0203dd4ae8b4c38a540e015

MD5 hash:

91c3f9e8c51c886bf15beef26f10aff5

SHA1 hash:

e0f9cfd52f50af2f6bd7e64be1a8f7db1ef2a2c6

Detections:

win_lokipws_g0

win_lokipws_auto

Link:

https://www.unpac.me/results/49dba32c-0a85-426e-aad6-00415fee0f02/

Parent samples :

be67f258e34602b9bbafd2fe048d85ac1e8bedd7d0604d0354ff018503884a88
8cd7b7de5ee297ffccffb4b76da64f4e3dbbda669dc444785e0962b2b6a3b011
b1090fca7443fd9d5fae0f8490badf5676aeb2f79b0a08e6cb3b299d7c4fc4f2
1d885d15d44ee25d356b70b392b8e28afd66c96703653108224ae7337def768b
7218c94691a6d69887f816cd92e30530698611c4f94e1f50eeb239f2bd3eeb3a
f5ade0a0260b8579ba9359d6e87475ac27c10762e69a3761e2c7d8f30adcc1cc
11e96ba82cb0536580d6f328130842c9688daa24f50a1b47d33fe4c1d59aad1f
669247f973870da293e534e1dfad8ca9327cf2623cc5dc108fca05b7e0d701b2
93012a7147b7da80de93b498fc26ab906acc1066b3c207fda9e9787375b9206a
97c02ca229008a83a25508e29323a35da8dc8f2c2bdcaa0560fa4a12d6bbf871

SH256 hash:

24bae02056abde6d68745b4b9ecbc3693c4d9685db5921a18f87ef029d60a2cc

MD5 hash:

2e1342e640ba1f94f986b1043fa176e1

SHA1 hash:

f265f005125335cd2d71e055dcde58fa8ff4150e

Link:

https://www.unpac.me/results/49dba32c-0a85-426e-aad6-00415fee0f02/

SH256 hash:

f5ade0a0260b8579ba9359d6e87475ac27c10762e69a3761e2c7d8f30adcc1cc

MD5 hash:

8afe3b53001bfe71592d5a8471694619

SHA1 hash:

1eb02a941b241aaaf6f2eae57b66b5db3d78ce3b

Link:

https://www.unpac.me/results/49dba32c-0a85-426e-aad6-00415fee0f02/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/f5ade0a0260b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/f5ade0a0260b8579ba9359d6e87475ac27c10762e69a3761e2c7d8f30adcc1cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.