MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9a2f1e7311dab79c889621aeb6e11c48024343f8f44e787ab4903a8f2495554. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	f9a2f1e7311dab79c889621aeb6e11c48024343f8f44e787ab4903a8f2495554
SHA3-384 hash:	be508973547ab70f351cb00d4839bdb663b3412cda9f86b5100871703a070cc6310cf2014555f6542c9fff88bd3f1226
SHA1 hash:	907ce38d1654421cfd875031b8d5bf4334e8e644
MD5 hash:	aed7063ecfeb47a9ffbd2df244d7cf3c
humanhash:	princess-jersey-alpha-whiskey
File name:	Dhbceds.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	635'392 bytes
First seen:	2020-07-06 08:15:02 UTC
Last seen:	2020-07-06 09:06:31 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d7a6667308868eb5622c328a0adcf08f (3 x FormBook, 1 x RemcosRAT, 1 x Loki)
ssdeep	12288:ByiFoineGN96o8Esw7/DQY8S0UuY+V9i0Lv6:BDQGN91D7rt+UuY+VXLv6
Threatray	1'701 similar samples on MalwareBazaar
TLSH	D6D4AF61F2D28537C1671A3DCC5BA7B8A829BF512E2824475FE53D0C5F39782382AD93
Reporter	abuse_ch
Tags:	exe Loki

abuse_ch

Malspam distributing unidentified malware:

HELO: relay14.raiolanetworks.com
Sending IP: 217.182.121.197
From: giovannidesantis@agride.it
Reply-To: giovamidesantis@agride.it
Subject: Inquiry
Attachment: Inquiry.zip (contains "Dhbceds.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/21344/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f9a2f1e7311dab79c889621aeb6e11c48024343f8f44e787ab4903a8f2495554/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-07-06 05:18:48 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7grpdzzrdwvxtsejminow3qrysacinb7r5copb5ljeb2r4sjkvka._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

persistence trojan spyware stealer family:lokibot

Link:

https://tria.ge/reports/200706-wfzvzgefdn/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Program crash

Suspicious use of SetThreadContext

Adds Run entry to start application

Legitimate hosting services abused for malware hosting/C2

Lokibot

Malware Config

C2 Extraction:

http://beautynams.com/kuwait/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Please note that we are no longer able to provide a coverage score for Virus Total.