MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa4058c30f37d1cdb72e5bbcc467ff8f9b584b090bfdf723ac1f04817980096a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Loki

Vendor detections: 14

Intelligence 14 IOCs YARA 2 File information Comments

SHA256 hash:	fa4058c30f37d1cdb72e5bbcc467ff8f9b584b090bfdf723ac1f04817980096a
SHA3-384 hash:	101a269c1dcf1c91c6fd39843afd7f83b17052ccd1cf9c00bb6dc9c6c45a8310eb45b2993d2546c5855ed8b69daa7311
SHA1 hash:	cccce8eb2a301733a17cefc4783af2e25b05188a
MD5 hash:	b276cce5233ef4258af95456efb8aed8
humanhash:	angel-pasta-oklahoma-paris
File name:	Swift MT103.exe
Download:	download sample
Signature	Loki Create hunting rule
File size:	744'448 bytes
First seen:	2022-07-21 04:22:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'739 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:ls2hpeAdI9NAx5i9vdP/fb3HCBs7x0Y9n83pC2cZTqtjU5DdK/NC9u8PTIx8831h:hhQNA/i/fLHCu9+3A2cZTqtIDM0k8PUl
Threatray	8'559 similar samples on MalwareBazaar
TLSH	T1D7F4123B60F8AB11C93457F201A3578C1AF2B10E7475E25E3C9AE4DA85E47D4A6223E7
TrID	64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.5% (.SCR) Windows screen saver (13101/52/3) 9.2% (.EXE) Win64 Executable (generic) (10523/12/4) 5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	GovCERT_CH
Tags:	exe Loki

Intelligence

File Origin

# of uploads :

# of downloads :

303

Origin country :

n/a

Vendor Threat Intelligence

Detection:

LokiBot

Link:

https://www.capesandbox.com/analysis/293047/

Detection(s):

SecuriteInfo.com.Trojan.Packed2.44349.11880.14868-222265.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/62d8d4e5752a4892e1232d21/reports/4f4c7fb4-a1f9-47bc-a1b6-00d9cbb384a2/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bcee1214-cae3-47e3-9c7f-cc672096a546

Result

Threat name:

Lokibot

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1038301

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected AntiVM3

Yara detected aPLib compressed binary

Yara detected Generic Downloader

Yara detected Lokibot

Behaviour

Behavior Graph:

Download SVG

Detection:

lokibot

Link:

https://mwdb.cert.pl/sample/fa4058c30f37d1cdb72e5bbcc467ff8f9b584b090bfdf723ac1f04817980096a/

Threat name:

Win32.Backdoor.Androm

Status:

Malicious

First seen:

2022-07-21 04:23:08 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

16 of 26 (61.54%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7jafrqypg7i43nzolo6miz77r6nvqsyjbp67oi5md4cic6mabfva._file

Verdict:

malicious

Label(s):

lokipasswordstealer(pws)

Result

Malware family:

lokibot

Score:

10/10

Tags:

family:lokibot collection spyware stealer trojan

Link:

https://tria.ge/reports/220721-ezsv5scff5/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Lokibot

Malware Config

C2 Extraction:

http://198.187.30.47/p.php?id=10316882234268616
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Unpacked files

SH256 hash:

39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807

MD5 hash:

db51fe170a9e5d6ec5429a2fbd9d0353

SHA1 hash:

e30a58125fc41322db6cf2ccb6a6d414ed379016

Link:

https://www.unpac.me/results/505d3e8e-dfc4-4259-b441-af3333bb084c/

SH256 hash:

3a8d609d9ce80a5e7e5c113a9e30f84268f58acd8b0ea192262907c0ab1562d9

MD5 hash:

b387cda128811d3c01058d80c66fa469

SHA1 hash:

ccd1e8f7a7a8fe66c50ebca0860dee66ee2833b4

Link:

https://www.unpac.me/results/505d3e8e-dfc4-4259-b441-af3333bb084c/

SH256 hash:

707583235836f53147b71c57cd240fef351dfdc9e170e4e77812907afdce87fe

MD5 hash:

d91d84f660d5b91142c6471b2dfd9eb8

SHA1 hash:

85bf10c8d229bef5831c0b68ecbc92af2cc4f690

Link:

https://www.unpac.me/results/505d3e8e-dfc4-4259-b441-af3333bb084c/

SH256 hash:

ca4e3745f87ae419e10fa9dd15e9814f66a7dca601ae70bd3ae3b0b0781e9491

MD5 hash:

6491ab64072f34a6124f4cdf1d9bdd43

SHA1 hash:

78008e0c188d1732ebb5bbfe6d15892ebe32b1f7

Link:

https://www.unpac.me/results/505d3e8e-dfc4-4259-b441-af3333bb084c/

SH256 hash:

06535f6ed8de21369c67fd5c2f37688af55c21f57bcbf655b0f7ed128b2f1cf9

MD5 hash:

e36841343da08432d9dfca01728059a9

SHA1 hash:

16996ed3eb870bac3aaf793531c9baa0130f8143

Detections:

win_lokipws_g0

win_lokipws_auto

lokibot

Link:

https://www.unpac.me/results/505d3e8e-dfc4-4259-b441-af3333bb084c/

Parent samples :

a4bb6e9c41c7d7f5b782355f7fb056f44fe66ad6ebd0d589b7941b8905e219d8
a3d46f7fe68a30115c4eae725622d4336e7ea6dde46b0104d113ddd55ff1e5a5
c86ba22021597e8876b4432a5ffb954f495e7f2a0a926af5f630e1f3e3e8acf5
3ed8d8e12f6a32642e80244929d185d80bb599ba317628a32d9cea8f46cb5f45
2af4c514474e77feb774b9c0faf1b17a41f92dbbef37c9d3f2d5778223f9a733
fa4058c30f37d1cdb72e5bbcc467ff8f9b584b090bfdf723ac1f04817980096a

SH256 hash:

fa4058c30f37d1cdb72e5bbcc467ff8f9b584b090bfdf723ac1f04817980096a

MD5 hash:

b276cce5233ef4258af95456efb8aed8

SHA1 hash:

cccce8eb2a301733a17cefc4783af2e25b05188a

Link:

https://www.unpac.me/results/505d3e8e-dfc4-4259-b441-af3333bb084c/

Malware family:

Lokibot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fa4058c30f37/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fa4058c30f37d1cdb72e5bbcc467ff8f9b584b090bfdf723ac1f04817980096a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

exe fa4058c30f37d1cdb72e5bbcc467ff8f9b584b090bfdf723ac1f04817980096a

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/293047/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample