MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6f18795a315335a3dafb1a6b29b26ae849e5262e8094aee3bdd2e20da018a52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash:	f6f18795a315335a3dafb1a6b29b26ae849e5262e8094aee3bdd2e20da018a52
SHA3-384 hash:	86c2544f356b8e9a5bba98262108aeb36dece628f05abea8446fe51b1e4b68dae5d6a142d38cca25d53e9b47ababa36d
SHA1 hash:	c3cf6bf1be623e03fc8126b0e8934fe30d71034f
MD5 hash:	9ca2028b77c9c10edfdf958e3c103a5f
humanhash:	skylark-ceiling-kansas-venus
File name:	9ca2028b77c9c10edfdf958e3c103a5f.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	674'816 bytes
First seen:	2023-05-23 11:36:12 UTC
Last seen:	2023-05-23 12:24:43 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:PDX91REfPpbiTGI8arScyN+8bUakZP28M+JHYfyn5:PR1REfAmarSVNzAaqP3TxeS
Threatray	4'460 similar samples on MalwareBazaar
TLSH	T1E6E48D9533B5DF26D87D83FF06F0A08D0FB875067026E2195F9735D27270BA62A48A93
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	abuse_ch
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

270

Origin country :

Vendor Threat Intelligence

Malware family:

lokibot

ID:

File name:

SWIFT COPY.xls

Verdict:

Malicious activity

Analysis date:

2023-05-23 06:13:40 UTC

Tags:

opendir exploit cve-2017-11882 loader trojan lokibot

Link:

https://app.any.run/tasks/3f3898cb-6433-4011-af69-eb2c069c14ee

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.Siggen20.55491.2098.15202.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Unauthorized injection to a recently created process

Creating a file

Сreating synchronization primitives

Reading critical registry keys

Enabling the 'hidden' option for analyzed file

Stealing user critical data

Moving of the original file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

lolbin packed

Link:

https://www.filescan.io/uploads/646ca55ff7a5bcf785660ce0/reports/ffe1e575-21f9-471f-9e04-cc48b1746a30/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/f6f18795a315335a3dafb1a6b29b26ae849e5262e8094aee3bdd2e20da018a52

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/52eeb8ca-3f29-4596-9f62-d36b359618df

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1240760

Signature

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f6f18795a315335a3dafb1a6b29b26ae849e5262e8094aee3bdd2e20da018a52/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-05-23 03:35:08 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 37 (54.05%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=63yypfndcuzvupnpwgtlfgzgv2cj4utc5aeuv3r33uxcbwqbrjja._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/230523-nq59jsfh9t/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://185.246.220.60/fred2/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

4c7ce432433fc3a8b0a33d558e0041d3f1c222224c5e61f33104d990a534c7a4

MD5 hash:

e8d756b4e2de5a67446e0b1b80e1bb99

SHA1 hash:

b664448f87ac044a16706d35e5d76538ba79508a

Link:

https://www.unpac.me/results/c568ab1d-4b93-4c8e-ae1f-5fdb3399bb96/

SH256 hash:

16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d

MD5 hash:

fb4ed205b442f470bbf10913128efdcb

SHA1 hash:

9a0a4c5ae429769e3253a9a3daefa24270b87a5b

Link:

https://www.unpac.me/results/c568ab1d-4b93-4c8e-ae1f-5fdb3399bb96/

Parent samples :

ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e

SH256 hash:

29ab15921804c9c194b259d3692bb33e446b40cc8f73096dc03974facf1e9060

MD5 hash:

3c89b56f2e96babc60c1ca35d8f38611

SHA1 hash:

6d034ba2150434e3a3bcf4918b494c9f7f33f130

Detections:

lokibot

win_lokipws_auto

win_lokipws_g0

Link:

https://www.unpac.me/results/c568ab1d-4b93-4c8e-ae1f-5fdb3399bb96/

Parent samples :

5aa4e5f27db90a607fd574718308c861585f46b8577136f0dba2ea9390206764
d92380f84b9edde0fde90d9f6b5346980c2e66f55270ec08fdb0d74b0074aa5d
f6f18795a315335a3dafb1a6b29b26ae849e5262e8094aee3bdd2e20da018a52
05b7aca6ab73f6af9d21b04f6f48cafb1c04394e929f76ab5f7a69071b3d6076
773138409fdfff166094dd720d55edb343a5ac859c6e61ffc880df4be163f65c
3dbe655f05f4fb7b25e71f2630e3adce029b0fa2a5eda55a879227fab9e5d74a
a1cde47a700a9372c2de3c0566c895812dc3d9b7dd77e14c282c2e00611b436c

SH256 hash:

3f944efad0a9cef2ec4ae4c3436f27acc059f0fff0dd6d52e0565167ebc94cbc

MD5 hash:

8bca172591deaa8312c2d6b2a725918b

SHA1 hash:

21a1ea8d681a389ff8e2c588a993f8b9bede70e5

Link:

https://www.unpac.me/results/c568ab1d-4b93-4c8e-ae1f-5fdb3399bb96/

SH256 hash:

aa2c84c76cd5a488dcfecf0f72b0b6b7ce99e0f4e9460dc836a29ee947513f77

MD5 hash:

bef5e8968997d8feadf5e208ec0c7ad7

SHA1 hash:

06933e6f70cde7c52be0960339bfe15d8cdad00a

Detections:

lokibot

Link:

https://www.unpac.me/results/c568ab1d-4b93-4c8e-ae1f-5fdb3399bb96/

SH256 hash:

f6f18795a315335a3dafb1a6b29b26ae849e5262e8094aee3bdd2e20da018a52

MD5 hash:

9ca2028b77c9c10edfdf958e3c103a5f

SHA1 hash:

c3cf6bf1be623e03fc8126b0e8934fe30d71034f

Link:

https://www.unpac.me/results/c568ab1d-4b93-4c8e-ae1f-5fdb3399bb96/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/f6f18795a315335a3dafb1a6b29b26ae849e5262e8094aee3bdd2e20da018a52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

exe f6f18795a315335a3dafb1a6b29b26ae849e5262e8094aee3bdd2e20da018a52

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2635588/

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2639915/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample