MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9abc71a65beed84b344ec4ca11b2d242a9fba725fa5c12db5ad8152bd551826. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f9abc71a65beed84b344ec4ca11b2d242a9fba725fa5c12db5ad8152bd551826
SHA3-384 hash:	c58c52d97901b70872ba0fce36a62d374f5cd3103a32cabc1a19b382a5ba9226bd8b7bbb54ff12559d1a31f270f98a87
SHA1 hash:	2783bc79cf0d6c5dba2bd1507602ba50dd2453c5
MD5 hash:	e2a1993d059745a36a72582c89ad741b
humanhash:	eleven-two-johnny-butter
File name:	Maerskline Shipping Documents.exe
Download:	download sample
Signature	Loki Alert Create hunting rule
File size:	545'792 bytes
First seen:	2023-05-11 11:05:16 UTC
Last seen:	2023-05-15 10:22:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep	12288:cqUwmLTiCHvY7oCwGL7L34pJ7Re9fSlVXetRpDirO:ewmLTS7oNGfLIY9qlVXezpeO
Threatray	4'380 similar samples on MalwareBazaar
TLSH	T151C4BE85123BAFE2DAA413F0221434434B7DA11A75B8F0BC6E5BB4C9C8DEB115BD4B67
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	lowmal3
Tags:	exe Loki

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

349

Origin country :

DE

Vendor Threat Intelligence

ANY.RUN lokibot

Malware family:

lokibot

Alert

Create hunting rule

ID:

1

File name:

Maerskline Shipping Documents.exe

Verdict:

Malicious activity

Analysis date:

2023-05-11 11:06:12 UTC

Tags:

trojan lokibot

Link:

https://app.any.run/tasks/a4b6f732-80ef-4368-ae34-f72f4dd24eb7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox LokiBot

Detection:

LokiBot

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/388398/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Enabling the 'hidden' option for analyzed file

Moving of the original file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

barys comodo lokibot packed

Link:

https://www.filescan.io/uploads/645ccc1aa2bbacddad9c13a2/reports/d4b111b1-c9b3-40af-9d2c-726077dade7f/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/f9abc71a65beed84b344ec4ca11b2d242a9fba725fa5c12db5ad8152bd551826

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Loki

Malware family:

Loki

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f2c34936-efbe-4eaf-9181-72315d4d44fb

Joe Sandbox Lokibot

Result

Threat name:

Lokibot

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1230737

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f9abc71a65beed84b344ec4ca11b2d242a9fba725fa5c12db5ad8152bd551826/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.SnakeKeylogger

Threat name:

ByteCode-MSIL.Trojan.SnakeKeylogger

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-11 07:36:50 UTC

File Type:

PE (.Net Exe)

Extracted files:

9

AV detection:

17 of 24 (70.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7gv4ogtfx3wyjm2e5rgkcgzneqvj7otsl6s4clnvvwavfpkvdata._file

Threatray lokipasswordstealer(pws)

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Alert

Create hunting rule

Similar samples:

0211f1dc94407a86459131e36dcffe165c9329eaac37c195701817260a3e01d6

Loki

0eaeda634e3df8cd7985a88a15ed14167877ab010f3b8cab9f03bdeba2d361a2

Loki

1e0557bb24ff7057aa35904c7ce0edf8cd20c7dee89bbcd9485cce5b04fb80ce

Loki

23dbc26b804d9759bf1071f4972658b648b6aa0ffe4a68986282c38fb9702ecd

Loki

28a4489a297705ee3a1b429ab4799eceed929b25592a0bbf4aca2dea07ef719e

Loki

4920cdf96db967e0df5414de0d8318d018be7af985158dddd3a4cf77af565bf9

Loki

50b98481af6d01585e639143040a43d067403bc84511267fc4ea965966a9f1d1

Loki

57ff6de510ccaa060efa53e2c9e1c1b8c3b132fa55289a8a7ecc321a5370043a

Loki

68de9f9de58cc646734a635dc1c3b3a6747a7ebf746f3a4910d130ddc52c38d1

Loki

7b96a1bf0bc01fdb25ed2343448b412df9e154cec081970bf360096b995be9f6

Loki

+ 4'370 additional samples on MalwareBazaar

Hatching Triage lokibot

Result

Malware family:

lokibot

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/230511-m7dp7aeh6t/

Behaviour

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://104.156.227.195/~blog/?p=9998124331886
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

UnpacMe lokibot win_lokipws_auto win_lokipws_g0

Unpacked files

SH256 hash:

f757686e32314bcae37b5be87facafc64e77f1345beff56eb30731f838c631f6

MD5 hash:

29c68c73ef99dad63cb569dec3b8b469

SHA1 hash:

da4319a3620ff2c4665889f41626e63e9365ef79

Link:

https://www.unpac.me/results/ae976261-83c7-46ab-813e-f321cc2f1556/

SH256 hash:

ee7d7f31607fd216273a9f0954e11fa4fb0c4dddcb565cdd9fb4b5acf40d9c1b

MD5 hash:

45a5fe88e0edfc1700ce7fdd35edf791

SHA1 hash:

d3ed9b92f6b80f1ee79f01fb0b3d09deb7660b8a

Detections:

lokibot

Alert

Create hunting rule

win_lokipws_auto

Alert

Create hunting rule

win_lokipws_g0

Alert

Create hunting rule

Link:

https://www.unpac.me/results/ae976261-83c7-46ab-813e-f321cc2f1556/

Parent samples :

57b52ccdf1b1bd983b94eb086e66941aff4f98e99f08083396c24aeefc73a53d
68de9f9de58cc646734a635dc1c3b3a6747a7ebf746f3a4910d130ddc52c38d1
57ff6de510ccaa060efa53e2c9e1c1b8c3b132fa55289a8a7ecc321a5370043a
f9abc71a65beed84b344ec4ca11b2d242a9fba725fa5c12db5ad8152bd551826
7e8b72a7c61a9208a481548a491eb45817c603046992114016383d82adde5fe3
7de41879a47b6376ca77af402221e7d559437a2679e9322ed31453b2c476c683

SH256 hash:

872b275e1defeebc3a93f2783a8644102860ae883f6cde2b4cde00e4ddc29a38

MD5 hash:

8b4e7eeb6cbf73a98f85c5e3ff0043a8

SHA1 hash:

ae270985ff9cce71c9e6824d2fd2c38d75671646

Link:

https://www.unpac.me/results/ae976261-83c7-46ab-813e-f321cc2f1556/

SH256 hash:

993d2efd81586271bae7f7eb3ceaa743ee48fdcec5a0973fb07cc1e60523b297

MD5 hash:

47b0ed7276cc06e86fe7be1b873dfc44

SHA1 hash:

469001644cca773b369dd9b200ec1e15bfc034b1

Link:

https://www.unpac.me/results/ae976261-83c7-46ab-813e-f321cc2f1556/

SH256 hash:

73d02d08e76e62e0dd38b501dfe6a66e66d25bc3b33c5fbdb9625ef3ad0ac960

MD5 hash:

203c212e2c86247f8864a76227b5761f

SHA1 hash:

37789964d943115442f32cc13541f987ffbd9d2f

Link:

https://www.unpac.me/results/ae976261-83c7-46ab-813e-f321cc2f1556/

SH256 hash:

f9abc71a65beed84b344ec4ca11b2d242a9fba725fa5c12db5ad8152bd551826

MD5 hash:

e2a1993d059745a36a72582c89ad741b

SHA1 hash:

2783bc79cf0d6c5dba2bd1507602ba50dd2453c5

Link:

https://www.unpac.me/results/ae976261-83c7-46ab-813e-f321cc2f1556/

VMRay Lokibot

Malware family:

Lokibot

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f9abc71a65be/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

exe f9abc71a65beed84b344ec4ca11b2d242a9fba725fa5c12db5ad8152bd551826

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/388398/