analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

BAL008 - BA195556834512.PDF (1).iso

Full analysis: https://app.any.run/tasks/00bea2fa-d473-442d-8ff0-0a717e59d40f
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Malware Trends Tracker     >>>
Analysis date: March 22, 2019, 12:27:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
lokibot
Indicators:
MIME: application/x-iso9660-image
File info: ISO 9660 CD-ROM filesystem data 'BAL008 - BA195556834512.PDF'
MD5:

AC01C6094451F0CA78D23B80CC21BA7B

SHA1:

B696A0B2C0332AB2B2E9FE305D6AA3C33E1C7B4E

SHA256:

350E9E9BDA2A177330B5492EF98D78B81259F18C0A32893D4E04B1EA0FA60DCD

SSDEEP:

6144:nm3LOKsxJROBgfciu158VfhUGso4OJwzb1iZR5w0NWfZNK8JIkEfGg:nm3LLsjfNu150fYpJzb1iZvrWnK8qk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • BAL008 - BA195556834512.PDF.com (PID: 3148)
      • BAL008 - BA195556834512.PDF.com (PID: 3824)
      • BAL008 - BA195556834512.PDF.com (PID: 2420)

    • Detected artifacts of LokiBot

      • BAL008 - BA195556834512.PDF.com (PID: 3148)

    • LOKIBOT was detected

      • BAL008 - BA195556834512.PDF.com (PID: 3148)

    • Connects to CnC server

      • BAL008 - BA195556834512.PDF.com (PID: 3148)

    • Actions looks like stealing of personal data

      • BAL008 - BA195556834512.PDF.com (PID: 3148)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • BAL008 - BA195556834512.PDF.com (PID: 2420)
      • WinRAR.exe (PID: 2832)
      • BAL008 - BA195556834512.PDF.com (PID: 3824)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2832)
      • BAL008 - BA195556834512.PDF.com (PID: 3148)

    • Application launched itself

      • BAL008 - BA195556834512.PDF.com (PID: 2420)

    • Loads DLL from Mozilla Firefox

      • BAL008 - BA195556834512.PDF.com (PID: 3148)

    • Creates files in the user directory

      • BAL008 - BA195556834512.PDF.com (PID: 3148)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.iso | ISO 9660 CD image (27.6)
.atn | Photoshop Action (27.1)
.gmc | Game Music Creator Music (6.1)

EXIF

ISO

System: Win32
VolumeName: BAL008 - BA195556834512.PDF
VolumeBlockCount: 246
VolumeBlockSize: 2048
RootDirectoryCreateDate: 2019:03:22 10:27:12+01:00
Software: PowerISO
VolumeCreateDate: 2019:03:22 10:27:12.00+01:00
VolumeModifyDate: 2019:03:22 10:27:12.00+01:00

Composite

VolumeSize: 492 kB
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
5
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start rundll32.exe no specs winrar.exe bal008 - ba195556834512.pdf.com no specs bal008 - ba195556834512.pdf.com no specs #LOKIBOT bal008 - ba195556834512.pdf.com

Process information

PID
CMD
Path
Indicators
Parent process
2980"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\BAL008 - BA195556834512.PDF (1).isoC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2832"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\BAL008 - BA195556834512.PDF (1).iso"C:\Program Files\WinRAR\WinRAR.exe
rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3824"C:\Users\admin\AppData\Local\Temp\Rar$DIa2832.20883\BAL008 - BA195556834512.PDF.com" C:\Users\admin\AppData\Local\Temp\Rar$DIa2832.20883\BAL008 - BA195556834512.PDF.com—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
2420"C:\Users\admin\AppData\Local\Temp\Rar$DIa2832.20883\BAL008 - BA195556834512.PDF.com" C:\Users\admin\AppData\Local\Temp\Rar$DIa2832.20883\BAL008 - BA195556834512.PDF.com—BAL008 - BA195556834512.PDF.com
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
3148"C:\Users\admin\AppData\Local\Temp\Rar$DIa2832.20883\BAL008 - BA195556834512.PDF.com" C:\Users\admin\AppData\Local\Temp\Rar$DIa2832.20883\BAL008 - BA195556834512.PDF.com
BAL008 - BA195556834512.PDF.com
User:
admin
Integrity Level:
MEDIUM
Version:
1.00
Total events
911
Read events
819
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
4
Unknown types
2

Dropped files

PID
Process
Filename
Type
3148BAL008 - BA195556834512.PDF.comC:\Users\admin\AppData\Roaming\F63AAA\A71D80.lck —
MD5:—
SHA256:—
3148BAL008 - BA195556834512.PDF.comC:\Users\admin\AppData\Roaming\F63AAA\A71D80.exeexecutable
MD5:6A4F0613A1116C07DAB4C2365A85ADA6
SHA256:52C1EDBA935857A2FFCBCBFBD1C67BB7C3550E00743B5431BF346761F3C66E14
2832WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2832.20883\BAL008 - BA195556834512.PDF.comexecutable
MD5:6A4F0613A1116C07DAB4C2365A85ADA6
SHA256:52C1EDBA935857A2FFCBCBFBD1C67BB7C3550E00743B5431BF346761F3C66E14
3148BAL008 - BA195556834512.PDF.comC:\Users\admin\AppData\Roaming\F63AAA\A71D80.hdbtext
MD5:5302B1B5EC232D44E2D9507FB847FC49
SHA256:20B58A25872B1E3F7D47DAE0C090ACF229C49B6E33939934513499CC37BB2684
3824BAL008 - BA195556834512.PDF.comC:\Users\admin\AppData\Local\VirtualStore\Windows\win.initext
MD5:D2A2412BDDBA16D60EC63BD9550D933F
SHA256:79FF2254E38192BE1626D05BEC6C82E10C85E1CF91DF7440C4C443380A1E877A
2420BAL008 - BA195556834512.PDF.comC:\Users\admin\AppData\Local\VirtualStore\Windows\win.initext
MD5:D2A2412BDDBA16D60EC63BD9550D933F
SHA256:79FF2254E38192BE1626D05BEC6C82E10C85E1CF91DF7440C4C443380A1E877A
3148BAL008 - BA195556834512.PDF.comC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:18B8CFC0185C50383AAC0A4F30A9DAC8
SHA256:913E8CED6A447FE791954D382ABA52D490513C5D2F689B391866C7E561F89A03
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3148
BAL008 - BA195556834512.PDF.com
POST
—
104.27.153.53:80
http://zentacher2.gq/tuneshi/fre.php
US
—
—
malicious
3148
BAL008 - BA195556834512.PDF.com
POST
—
104.27.153.53:80
http://zentacher2.gq/tuneshi/fre.php
US
—
—
malicious
3148
BAL008 - BA195556834512.PDF.com
POST
—
104.27.153.53:80
http://zentacher2.gq/tuneshi/fre.php
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3148
BAL008 - BA195556834512.PDF.com
104.27.153.53:80
zentacher2.gq
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
zentacher2.gq
  • 104.27.153.53
  • 104.27.152.53
malicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .gq Domain
3148
BAL008 - BA195556834512.PDF.com
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3148
BAL008 - BA195556834512.PDF.com
A Network Trojan was detected
ET TROJAN LokiBot Checkin
3148
BAL008 - BA195556834512.PDF.com
Potentially Bad Traffic
ET INFO HTTP POST Request to Suspicious *.gq domain
3148
BAL008 - BA195556834512.PDF.com
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
3148
BAL008 - BA195556834512.PDF.com
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
3148
BAL008 - BA195556834512.PDF.com
A Network Trojan was detected
MALWARE [PTsecurity] Loki Bot Check-in M2
3148
BAL008 - BA195556834512.PDF.com
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3148
BAL008 - BA195556834512.PDF.com
A Network Trojan was detected
ET TROJAN LokiBot Checkin
3148
BAL008 - BA195556834512.PDF.com
Potentially Bad Traffic
ET INFO HTTP POST Request to Suspicious *.gq domain
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
BAL008 - BA195556834512.PDF (1).iso