analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Mailupdate.ace

Full analysis: https://app.any.run/tasks/ae359a59-348b-4628-8815-672a92cdbc4b
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Analysis date: March 31, 2020, 07:09:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
lokibot
Indicators:
MIME: application/octet-stream
File info: ACE archive data version 20, from Win/32, version 20 to extract, solid
MD5:

B4C5EAA57477F9682A25B7CB84FA9DE6

SHA1:

14EEFD5E5A28B49CF2953BB8DFAC161E037AEE84

SHA256:

384851B8903DFA4396EB4620B80AFA700E8B66BA634CAA4A58302B2E13123040

SSDEEP:

384:dzyjShZf+O+mf6VPLxNtkABhFp3/1tWGvt6s7Oq5d029Udc:RyjShYO9fePLKABhFZSG0sv3XUy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Mailupdate.exe (PID: 1944)
      • Mailupdate.exe (PID: 3272)
      • Mailupdate.exe (PID: 2556)
    • LOKIBOT was detected

      • Mailupdate.exe (PID: 1944)
    • Connects to CnC server

      • Mailupdate.exe (PID: 1944)
    • Actions looks like stealing of personal data

      • Mailupdate.exe (PID: 1944)
  • SUSPICIOUS

    • Application launched itself

      • Mailupdate.exe (PID: 2556)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3952)
      • Mailupdate.exe (PID: 1944)
    • Reads Internet Cache Settings

      • Mailupdate.exe (PID: 1944)
    • Loads DLL from Mozilla Firefox

      • Mailupdate.exe (PID: 1944)
    • Creates files in the user directory

      • Mailupdate.exe (PID: 1944)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ace | ACE compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
4
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe mailupdate.exe no specs mailupdate.exe #LOKIBOT mailupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
3952"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Mailupdate.ace"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3272"C:\Users\admin\AppData\Local\Temp\Rar$EXa3952.46988\Mailupdate.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3952.46988\Mailupdate.exeWinRAR.exe
User:
admin
Company:
FORSRGEL
Integrity Level:
MEDIUM
Description:
zac
Exit code:
3221226540
Version:
1.00
2556"C:\Users\admin\AppData\Local\Temp\Rar$EXa3952.46988\Mailupdate.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3952.46988\Mailupdate.exe
WinRAR.exe
User:
admin
Company:
FORSRGEL
Integrity Level:
HIGH
Description:
zac
Exit code:
0
Version:
1.00
1944"C:\Users\admin\AppData\Local\Temp\Rar$EXa3952.46988\Mailupdate.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3952.46988\Mailupdate.exe
Mailupdate.exe
User:
admin
Company:
FORSRGEL
Integrity Level:
HIGH
Description:
zac
Version:
1.00
Total events
497
Read events
462
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
1944Mailupdate.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.lck
MD5:
SHA256:
3952WinRAR.exeC:\Users\admin\Desktop\Mailupdate.exeexecutable
MD5:A958CB4CEDDF0B086CD5C2F0B41C347C
SHA256:A9A7E47F8BA5A08A5FF3978C8A6EE41606B6863306C5574D1BE36D9C310591DD
1944Mailupdate.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.exeexecutable
MD5:A958CB4CEDDF0B086CD5C2F0B41C347C
SHA256:A9A7E47F8BA5A08A5FF3978C8A6EE41606B6863306C5574D1BE36D9C310591DD
3952WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3952.46988\Mailupdate.exeexecutable
MD5:A958CB4CEDDF0B086CD5C2F0B41C347C
SHA256:A9A7E47F8BA5A08A5FF3978C8A6EE41606B6863306C5574D1BE36D9C310591DD
1944Mailupdate.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.hdbtext
MD5:5302B1B5EC232D44E2D9507FB847FC49
SHA256:20B58A25872B1E3F7D47DAE0C090ACF229C49B6E33939934513499CC37BB2684
1944Mailupdate.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2fdbf
MD5:18B8CFC0185C50383AAC0A4F30A9DAC8
SHA256:913E8CED6A447FE791954D382ABA52D490513C5D2F689B391866C7E561F89A03
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
8
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1944
Mailupdate.exe
POST
404
35.246.219.215:80
http://castmart.ga/~zadmin/lmark/jun/link.php
US
text
15 b
malicious
1944
Mailupdate.exe
POST
404
35.246.219.215:80
http://castmart.ga/~zadmin/lmark/jun/link.php
US
text
15 b
malicious
1944
Mailupdate.exe
POST
404
35.246.219.215:80
http://castmart.ga/~zadmin/lmark/jun/link.php
US
binary
23 b
malicious
1944
Mailupdate.exe
POST
404
35.246.219.215:80
http://castmart.ga/~zadmin/lmark/jun/link.php
US
binary
23 b
malicious
1944
Mailupdate.exe
POST
404
35.246.219.215:80
http://castmart.ga/~zadmin/lmark/jun/link.php
US
binary
23 b
malicious
1944
Mailupdate.exe
POST
404
35.246.219.215:80
http://castmart.ga/~zadmin/lmark/jun/link.php
US
binary
23 b
malicious
1944
Mailupdate.exe
POST
404
35.246.219.215:80
http://castmart.ga/~zadmin/lmark/jun/link.php
US
binary
23 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1944
Mailupdate.exe
35.246.219.215:80
allenservice.ga
US
malicious

DNS requests

Domain
IP
Reputation
allenservice.ga
  • 35.246.219.215
malicious
castmart.ga
  • 35.246.219.215
unknown

Threats

PID
Process
Class
Message
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .ga Domain
1944
Mailupdate.exe
A Network Trojan was detected
MALWARE [PTsecurity] EJNT_Loader
1944
Mailupdate.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loki/Pony Bot Artifact Check-in
1944
Mailupdate.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
1944
Mailupdate.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
1944
Mailupdate.exe
Potentially Bad Traffic
ET INFO HTTP POST Request to Suspicious *.ga Domain
1944
Mailupdate.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
1944
Mailupdate.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
1944
Mailupdate.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loki Bot Check-in M2
1944
Mailupdate.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
2 ETPRO signatures available at the full report
No debug info