MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f84353a028d1c96db9ef3c775085e12c5222e3f41f4307f04db938a7b3be9d5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 19


Intelligence 19 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f84353a028d1c96db9ef3c775085e12c5222e3f41f4307f04db938a7b3be9d5d
SHA3-384 hash: f3811ea47f5adf15e695fb6a29a361a16565f6dc42e2b8d1fed02940259483775a87e7adeb2ed5e8463e5edac0e3ad0b
SHA1 hash: dcb9eb63d7b108a70845714e0c57cb5d2b3a577e
MD5 hash: 87f238930601f582b9d2e22c94e53a16
humanhash: beryllium-angel-social-oranges
File name:file
Download: download sample
Signature Loki
Create hunting rule
File size:175'474 bytes
First seen:2023-02-22 16:34:26 UTC
Last seen:2023-02-22 18:38:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 431 x GuLoader)
ssdeep 3072:XfY/TU9fE9PEtujb2OVaR5E1Na0TvimPut0Yoi7y0hTsLnlTW10AAyq0QI:PYa6d2OVM5kN/lut0Yoivo4Myq09
Threatray 414 similar samples on MalwareBazaar
TLSH T1D904021466F0C1B7EC624B721EBA9366BFEEF9121494C60BA700455D3A217D0DE1EB63
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter jstrosch
Tags:exe Loki

Intelligence

File Origin
# of uploads :
2
# of downloads :
249
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
http://46.183.221.4/3243/vbc.exe
Verdict:
Malicious activity
Analysis date:
2023-02-22 06:51:24 UTC
Tags:
opendir loader stealer trojan lokibot
Link:
https://app.any.run/tasks/98ed56e8-424c-48a4-9b41-0919d723e6c3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/369111/
Detection(s):
SecuriteInfo.com.FileRepMalware.6240.12906.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Reading critical registry keys
Searching for the window
Changing a file
Sending an HTTP POST request
Moving a file to the %AppData% subdirectory
Enabling the 'hidden' option for recently created files
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/72266/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
83%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63f6443ba6ba2f75a97a7086/reports/85750180-0964-43d6-ac5b-53472e49aa5b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/f84353a028d1c96db9ef3c775085e12c5222e3f41f4307f04db938a7b3be9d5d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ce21b05e-1c96-480d-a22f-eb2515bba3e7
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1180776
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 813604 Sample: file.exe Startdate: 22/02/2023 Architecture: WINDOWS Score: 100 43 Snort IDS alert for network traffic 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Antivirus detection for URL or domain 2->47 49 6 other signatures 2->49 8 file.exe 19 2->8         started        11 ameh.exe 1 2->11         started        process3 file4 37 C:\Users\user\AppData\Local\Temp\wntha.exe, PE32 8->37 dropped 14 wntha.exe 1 3 8->14         started        59 Multi AV Scanner detection for dropped file 11->59 18 WerFault.exe 3 10 11->18         started        20 conhost.exe 11->20         started        signatures5 process6 file7 39 C:\Users\user\AppData\Roaming\...\ameh.exe, PE32 14->39 dropped 61 Multi AV Scanner detection for dropped file 14->61 63 Detected unpacking (changes PE section rights) 14->63 65 Detected unpacking (overwrites its own PE header) 14->65 67 2 other signatures 14->67 22 wntha.exe 54 14->22         started        27 ameh.exe 1 14->27         started        29 conhost.exe 14->29         started        signatures8 process9 dnsIp10 41 185.246.220.85, 49716, 49718, 49720 LVLT-10753US Germany 22->41 35 C:\Users\user\AppData\...\B52B3F.exe (copy), PE32 22->35 dropped 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 22->51 53 Tries to steal Mail credentials (via file / registry access) 22->53 55 Tries to harvest and steal ftp login credentials 22->55 57 Tries to harvest and steal browser information (history, passwords, etc) 22->57 31 WerFault.exe 10 27->31         started        33 conhost.exe 27->33         started        file11 signatures12 process13
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f84353a028d1c96db9ef3c775085e12c5222e3f41f4307f04db938a7b3be9d5d/
Threat name:
Win32.Trojan.GenShell
Create hunting rule
Status:
Malicious
First seen:
2023-02-22 10:04:34 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7bbvhibi2hew3opphr3vbbpbfrjcfy7ud5bqp4cnxe4kpm56tvoq._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
165a4a13cc076a6cf2a41f4b6bb1d2336033d9976d0abb8f02e941eb64a6f963
Loki
1eda178f7d1d7e718231dcdb124f55109aae03d6fe7583fc5c1e8cae4d6c65bd
Loki
2a6ce3844cb0426fefb02d57bbb8eab576d0f089231c61aa1293cf0028d1db85
Loki
8447a1c529bb04ac97e6b9ad4ebbf0ee99d64af1a7cdb52ba4347906056bdcbf
Loki
a7cb7ee338eb9fb257e7bac8e36f6b8e8045a2a09349a3aadc4e8ca87d8c22f6
Loki
ab3552ba960757c704f2942338d3e9e3792fba42245e580afb6cfe2a6ecec242
Loki
e3f0cf7effaf970e55ce7b44afa66607f8126403523b609849339d551011480f
Loki
ff235029990af0449ce8f82c5546dfe37170d5e27ce1a22b0a43965a980344be
Loki
+ 404 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection persistence spyware stealer trojan
Link:
https://tria.ge/reports/230222-t3n4pacf25/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://185.246.220.85/bally/five/fre,php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
eb178783d0cd636c78e1ea3ca9a2678d521f73553b988a2d691a317cf7c12af2
MD5 hash:
e94bec5a4e3e0ad2c8094149c10de17c
SHA1 hash:
84fa82b4245cf336cb855381c419bd2b8b56f638
Detections:
lokibot
Create hunting rule
win_lokipws_auto
Create hunting rule
win_lokipws_g0
Create hunting rule
Link:
https://www.unpac.me/results/81e26e1d-edfb-4d55-a239-faab00e50fa3/
Parent samples :
21b866a6443ad4f626f2b192c09cbd81802f36bb7df8c1c6f0fa9ef416d6ed1d
f84353a028d1c96db9ef3c775085e12c5222e3f41f4307f04db938a7b3be9d5d
SH256 hash:
5729357156342ca98a891732fdb34fe5803f3be5df1409d4cf11866044e8e72f
MD5 hash:
b448e1f428261256956a25c9492ef879
SHA1 hash:
69f55cc1d2a087ea80001dc1054c9ce6cd38ef97
Link:
https://www.unpac.me/results/81e26e1d-edfb-4d55-a239-faab00e50fa3/
SH256 hash:
f84353a028d1c96db9ef3c775085e12c5222e3f41f4307f04db938a7b3be9d5d
MD5 hash:
87f238930601f582b9d2e22c94e53a16
SHA1 hash:
dcb9eb63d7b108a70845714e0c57cb5d2b3a577e
Link:
https://www.unpac.me/results/81e26e1d-edfb-4d55-a239-faab00e50fa3/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f84353a028d1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/f84353a028d1c96db9ef3c775085e12c5222e3f41f4307f04db938a7b3be9d5d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:LokiBot
Create hunting rule
Author:kevoreilly
Description:LokiBot Payload
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:Windows_Trojan_Lokibot_0f421617
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Lokibot_1f885282
Create hunting rule
Author:Elastic Security
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Loki

Executable exe f84353a028d1c96db9ef3c775085e12c5222e3f41f4307f04db938a7b3be9d5d

(this sample)

  
Delivery method
Distributed via web download
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/369111/

Comments