MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffef49c9a15cbb75e32c4329a27bf4e663b5892f6768d4a19abd628341d99d34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 14


Intelligence 14 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ffef49c9a15cbb75e32c4329a27bf4e663b5892f6768d4a19abd628341d99d34
SHA3-384 hash: ee3129003aa85a34534703d14f153b1e9a8d2f9a181961ed68a08cca276368dd299588ae7f440c2aa46fba20eba42665
SHA1 hash: 5e0d5c4858a0a46aa163cf40ea0f9655771c5b61
MD5 hash: 291a69c03db19a95a99fa31c31c89cbf
humanhash: oklahoma-jupiter-artist-winter
File name:10027389222.exe
Download: download sample
Signature Loki
Create hunting rule
File size:751'616 bytes
First seen:2022-02-18 04:22:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:d/aRud5VkoGPtlRugs2nIvafHeMgg9vtrFBkUwlUZ7FVCWIklM:dyMozRujBDgdtrFBkUwlUYW3
Threatray 6'965 similar samples on MalwareBazaar
TLSH T191F49D1635EF9052C362ABF28FD9ACBF47AEF173260B753935C5274A8722B409902375
Reporter GovCERT_CH
Tags:exe Loki

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
n/a
Vendor Threat Intelligence
Detection:
LokiBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/242427/
Detection(s):
SecuriteInfo.com.Trojan.Siggen16.57439.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
Reading critical registry keys
Changing a file
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for analyzed file
Stealing user critical data
Moving of the original file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe obfuscated packed
Link:
https://www.filescan.io/uploads/620f1f27a2660f3bb9f7b5d0/reports/417137e9-55da-4536-ac8b-c719770cff43/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
Lokibot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/942016
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Yara detected AntiVM3
Yara detected aPLib compressed binary
Yara detected Lokibot
Behaviour
Behavior Graph:
Download SVG
Detection:
lokibot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ffef49c9a15cbb75e32c4329a27bf4e663b5892f6768d4a19abd628341d99d34/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2022-02-18 04:23:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=77xutsnbls5xlyzmimu2e67u4zr3lcjpm5unjim2xvrigqoztu2a._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
Similar samples:
12f56e0170dd0bd765e935c0709c11a32cf916a9f1f12028e9af123c0a23b8a4
Loki
231af4f9626622427ed4df07e6ed351172b9a3417ee26235ba05ec14ed7dc7e4
Loki
58540b0c7fa89e78f3a5c8f47beda3c43dd1a960ecd732ebc5ec203711d812ce
Loki
a3c57266f4f2f229c35a60c0c07914b8029d22f4e258288b296b3e2669e1d566
Loki
ef85d2ccb9824e4eb3436002c2ddb3d96ad999f6e8c96382e0c9b6d95f3440aa
Loki
f92ed4b914d93884de367cf9e7878d68bf45f7ab2b6c46abb425c029e791208f
Loki
+ 6'955 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:lokibot collection spyware stealer trojan
Link:
https://tria.ge/reports/220218-ezsv5saec7/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of web browsers
Lokibot
Malware Config
C2 Extraction:
http://164.90.194.235/?id=60145368870173853
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Unpacked files
SH256 hash:
a8269d1c45cef0a7063204ae26a99ca631a222d4fdc638bf0371c7907301878a
MD5 hash:
19a502fe82782fad9720126ab74c40ab
SHA1 hash:
f7f11a33af2b47eb63910c7fa45af633b379c6d4
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
Link:
https://www.unpac.me/results/2962416f-26ce-4045-84da-ecd31c7af708/
Parent samples :
03735ed519d86a5d8456393b63d97be01c426c4b441c49efd2fd010c5faf78ce
c079342a5d8fbbdb05e32bf5c3d0e9b93a11a582d7404d448c5db52b08a98163
4700eeb43e73c4dceeb5bf6f05206e65cd36a8af558b9b529e79ac614e567f7a
ffef49c9a15cbb75e32c4329a27bf4e663b5892f6768d4a19abd628341d99d34
d916db2d430e2670b9e6a5995681ddf48c789ce1dcfaa3c0a02c0e8fee2f4123
SH256 hash:
6b84a78af0562eaefa74def1e6726c5502f91d80e2b29798e48462b1366e1eb8
MD5 hash:
e3dbe56d8cee079dc36cd34aac1c2110
SHA1 hash:
a78325fa06e33c991df2f7d658f1192970e0646d
Link:
https://www.unpac.me/results/2962416f-26ce-4045-84da-ecd31c7af708/
SH256 hash:
e33254e2ad4d279914a29450f98d1750a9f513fc8ddb853e0dd8346b805faa43
MD5 hash:
b597cce7bfc65e56fa69ebb7f413a33f
SHA1 hash:
7ee40df5ac783432e7c9f7be4f7ed1f286345d58
Link:
https://www.unpac.me/results/2962416f-26ce-4045-84da-ecd31c7af708/
SH256 hash:
e567dba61f4cb7c38719632dc6a6ffef20914ffd0abac6403ed4d0629b286b7b
MD5 hash:
190d28834a1e8e7a52906f5e0d8c2de7
SHA1 hash:
0a6781965454292a0f5bb5b345c2391507f27d1e
Link:
https://www.unpac.me/results/2962416f-26ce-4045-84da-ecd31c7af708/
SH256 hash:
ffef49c9a15cbb75e32c4329a27bf4e663b5892f6768d4a19abd628341d99d34
MD5 hash:
291a69c03db19a95a99fa31c31c89cbf
SHA1 hash:
5e0d5c4858a0a46aa163cf40ea0f9655771c5b61
Link:
https://www.unpac.me/results/2962416f-26ce-4045-84da-ecd31c7af708/
Malware family:
Lokibot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ffef49c9a15c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/ffef49c9a15cbb75e32c4329a27bf4e663b5892f6768d4a19abd628341d99d34

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:infostealer_loki
Create hunting rule
Rule name:infostealer_xor_patterns
Create hunting rule
Author:jeFF0Falltrades
Description:The XOR and string patterns shown here appear to be unique to certain information-stealing malware families, namely LokiBot and Pony/Fareit. The XOR patterns were observed in a several loaders and payloads for LokiBot, but have also appeared (less frequently) in Pony/Fareit loaders and samples. The two accompanying rules below can be used to further classify the final payloads.
Rule name:Loki
Create hunting rule
Author:kevoreilly
Description:Loki Payload
Rule name:malware_Lokibot_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Lokibot in memory
Reference:internal research
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:STEALER_Lokibot
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Lokibot stealer
Rule name:win_lokipws_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lokipws.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

Executable exe ffef49c9a15cbb75e32c4329a27bf4e663b5892f6768d4a19abd628341d99d34

(this sample)

  
Dropped by
loki
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/242427/

Comments