MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f6d0649facfffcdc2e79091b9854dca36b770b0090e17c5081a9c30711761455. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Loki
Vendor detections: 16
| SHA256 hash: | f6d0649facfffcdc2e79091b9854dca36b770b0090e17c5081a9c30711761455 |
|---|---|
| SHA3-384 hash: | 27bd83bd64e866b39aef2e9ebb4d5b96d30ccf1228005bafe30fb109635c119ef79b935a9435ee52c620e297829b93b5 |
| SHA1 hash: | 1abdfb8e0ff35ce056ec27753f24584e3728ab68 |
| MD5 hash: | 4249c08ffaef998e670f8bc5885de945 |
| humanhash: | pennsylvania-winner-florida-skylark |
| File name: | PO7865.exe |
| Download: | download sample |
| Signature | Loki |
| File size: | 637'440 bytes |
| First seen: | 2023-05-02 07:43:24 UTC |
| Last seen: | 2023-05-13 22:55:19 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 12288:xbSJgvm7Rik/Cm1jNQO1YeM+F3Kjx5rmDBVfmKo+7qH0s8M5CRCajH/sI9UH:xbSJgvm7Rikj5Q8F3ExGBVfmL+7tc5C4 |
| Threatray | 4'083 similar samples on MalwareBazaar |
| TLSH | T1DBD4063819BD1727C179D7F58FD08427F2A4A86B3021DE6568E767A6431AF1229C323F |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 38bc3ce4ccc6de0c (6 x AgentTesla, 4 x Loki, 2 x Formbook) |
| Reporter |  adrian__luca |
| Tags: | exe Loki |
Intelligence
File Origin
# of uploads :
2
# of downloads :
245
Origin country :
HUVendor Threat Intelligence
Malware family:
lokibot
ID:
1
File name:
PO7865.exe
Verdict:
Malicious activity
Analysis date:
2023-05-02 07:51:10 UTC
Tags:
trojan lokibot
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Enabling the 'hidden' option for analyzed file
Moving of the original file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed schtasks
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Verdict:
Malicious
Result
Threat name:
Lokibot
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-04-25 07:54:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
26 of 37 (70.27%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Similar samples:
+ 4'073 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Score:
10/10
Tags:
family:lokibot collection spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://185.246.220.85/testi/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
796d5505fd1fd1f2f012e207a2c8bb169998f038f0585b6118d04bec5723db9a
MD5 hash:
a1bcaede3a40aada9c0e5c07e986bc8f
SHA1 hash:
ffd69187d461840dda7a6d57f27cbc65a81ff8c2
Detections:
lokibot
win_lokipws_auto
win_lokipws_g0
SH256 hash:
829795ab5c8a80609cf3e7ce764ebf7fe33fd196b40d799670d23a3fcf85c0c1
MD5 hash:
219d339c63fcefe905193a88f71f2f87
SHA1 hash:
e2ca0aa9c7b1e2d7a52d7126333d34af5bacfb11
SH256 hash:
40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403
MD5 hash:
c768bac25fc6f0551a11310e7caba8d5
SHA1 hash:
95f9195e959fb48277c95d1dd1c97a4edff7cb3a
SH256 hash:
104cc6f47cdf3c60c59e3bca3067f3cb54f3f4912964d8617dd525a2b325c4fa
MD5 hash:
04d2a15f5e27f8a53e7e71c25e0c46ae
SHA1 hash:
893d029452bc5a322f1198e010e93ec834b06a51
SH256 hash:
ef8efe0d3c1e6bbad52c3607619b91c75d5409e6b53fb496c087e33ab10e7183
MD5 hash:
aced15733792501c4879ef87a5cbb7d5
SHA1 hash:
088737946bcc768844480337632a6541bf954bd8
SH256 hash:
f6d0649facfffcdc2e79091b9854dca36b770b0090e17c5081a9c30711761455
MD5 hash:
4249c08ffaef998e670f8bc5885de945
SHA1 hash:
1abdfb8e0ff35ce056ec27753f24584e3728ab68
Malware family:
Lokibot
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.