analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

OUTSTANDING PAYMENT.ZIP

Full analysis: https://app.any.run/tasks/f53921b5-9d1c-4821-87a3-0c34e6cb902b
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Analysis date: May 15, 2019, 08:22:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
lokibot
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

CA9F7C59FC9BA68EAE0A196936DA4E06

SHA1:

1DC1F160ACA9BD24C97C7B01AA2E2B385964CCCE

SHA256:

AFFA90EE21FCCE39D771107551403C2536D695510A05A24D7976420B0A9CBB34

SSDEEP:

768:H3e6PgttxCLChI0hJH4ETKZK/jYE3O/xT5MTmoNKlfVA+yNx5nolqgtlE:HUphIOZNKZKblO/3ImuNolq0E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 1260)
      • OUTLOOK.EXE (PID: 896)
    • Application was dropped or rewritten from another process

      • scan docs-file018374_pdf.exe (PID: 3892)
      • scan docs-file018374_pdf.exe (PID: 3140)
    • LOKIBOT was detected

      • scan docs-file018374_pdf.exe (PID: 3140)
    • Detected artifacts of LokiBot

      • scan docs-file018374_pdf.exe (PID: 3140)
    • Connects to CnC server

      • scan docs-file018374_pdf.exe (PID: 3140)
    • Actions looks like stealing of personal data

      • scan docs-file018374_pdf.exe (PID: 3140)
  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 1260)
      • OUTLOOK.EXE (PID: 896)
    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 1260)
    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 1260)
      • scan docs-file018374_pdf.exe (PID: 3140)
    • Application launched itself

      • scan docs-file018374_pdf.exe (PID: 3892)
    • Loads DLL from Mozilla Firefox

      • scan docs-file018374_pdf.exe (PID: 3140)
    • Executable content was dropped or overwritten

      • scan docs-file018374_pdf.exe (PID: 3140)
  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2360)
      • iexplore.exe (PID: 2516)
    • Application launched itself

      • iexplore.exe (PID: 2360)
      • iexplore.exe (PID: 2516)
    • Creates files in the user directory

      • iexplore.exe (PID: 2796)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2796)
      • iexplore.exe (PID: 2500)
    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 1260)
      • OUTLOOK.EXE (PID: 896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: OUTSTANDING PAYMENT (CORRECTED BANK DETAILS).msg
ZipUncompressedSize: 73216
ZipCompressedSize: 41068
ZipCRC: 0xf30761b5
ZipModifyDate: 2019:05:15 11:04:25
ZipCompression: Deflated
ZipBitFlag: 0x0003
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
15
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs outlook.exe iexplore.exe iexplore.exe winrar.exe no specs scan docs-file018374_pdf.exe no specs #LOKIBOT scan docs-file018374_pdf.exe outlook.exe iexplore.exe iexplore.exe explorer.exe no specs winrar.exe no specs winrar.exe no specs winrar.exe no specs winrar.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2892"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\OUTSTANDING PAYMENT.ZIP"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1260"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\Desktop\OUTSTANDING PAYMENT (CORRECTED BANK DETAILS).msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
2360"C:\Program Files\Internet Explorer\iexplore.exe" https://www.dropbox.com/s/0arxovuydr9xihw/scan%20docs-file018374_pdf.gz?dl=1C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2796"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2360 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1796"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\scan docs-file018374_pdf.gz"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3892"C:\Users\admin\Desktop\scan docs-file018374_pdf.exe" C:\Users\admin\Desktop\scan docs-file018374_pdf.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3140"C:\Users\admin\Desktop\scan docs-file018374_pdf.exe" C:\Users\admin\Desktop\scan docs-file018374_pdf.exe
scan docs-file018374_pdf.exe
User:
admin
Integrity Level:
MEDIUM
896"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\Desktop\OUTSTANDING PAYMENT (CORRECTED BANK DETAILS).msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
2516"C:\Program Files\Internet Explorer\iexplore.exe" https://www.dropbox.com/s/0arxovuydr9xihw/scan%20docs-file018374_pdf.gz?dl=1C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2500"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2516 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
5 563
Read events
4 550
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
6
Text files
56
Unknown types
10

Dropped files

PID
Process
Filename
Type
1260OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR53F4.tmp.cvr
MD5:
SHA256:
2892WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2892.7630\OUTSTANDING PAYMENT (CORRECTED BANK DETAILS).msgmsg
MD5:7B0F89D29191AB083C64D471CC0983D9
SHA256:CD25E96A45CAA9AA28409D05665B2F3B890295B9AEBB1257DB3C47F4020BCBBD
1260OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D5FFE722.datimage
MD5:E3E82F591A37BD37D06372EF12AC6C8F
SHA256:18CA98130A3DC028F4A28BC1D71D33933C4DCA629D241523B7E00A9016DF535D
2360iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico
MD5:
SHA256:
2796iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
2796iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0Y7XOFTR\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
1260OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_0BF40AC7E78C894A8D16740AA05AA678.datxml
MD5:BBCF400BD7AE536EB03054021D6A6398
SHA256:383020065C1F31F4FB09F448599A6D5E532C390AF4E5B8AF0771FE17A23222AD
2360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
2796iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@dropbox[1].txt
MD5:
SHA256:
2796iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
13
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1260
OUTLOOK.EXE
GET
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
whitelisted
3140
scan docs-file018374_pdf.exe
POST
47.254.173.224:80
http://flmates.com/wp/Panel/fre.php
US
malicious
3140
scan docs-file018374_pdf.exe
POST
47.254.173.224:80
http://flmates.com/wp/Panel/fre.php
US
malicious
896
OUTLOOK.EXE
GET
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
whitelisted
2360
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3140
scan docs-file018374_pdf.exe
POST
47.254.173.224:80
http://flmates.com/wp/Panel/fre.php
US
malicious
3140
scan docs-file018374_pdf.exe
POST
47.254.173.224:80
http://flmates.com/wp/Panel/fre.php
US
malicious
3140
scan docs-file018374_pdf.exe
POST
47.254.173.224:80
http://flmates.com/wp/Panel/fre.php
US
malicious
2516
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2360
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1260
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2796
iexplore.exe
162.125.66.6:443
uc8014b67ade3bc2255a07c8157f.dl.dropboxusercontent.com
Dropbox, Inc.
DE
shared
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
896
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2500
iexplore.exe
162.125.66.1:443
www.dropbox.com
Dropbox, Inc.
DE
shared
3140
scan docs-file018374_pdf.exe
47.254.173.224:80
flmates.com
Alibaba (China) Technology Co., Ltd.
US
suspicious
2796
iexplore.exe
162.125.66.1:443
www.dropbox.com
Dropbox, Inc.
DE
shared
2500
iexplore.exe
162.125.66.6:443
uc8014b67ade3bc2255a07c8157f.dl.dropboxusercontent.com
Dropbox, Inc.
DE
shared

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
www.dropbox.com
  • 162.125.66.1
shared
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
uc8014b67ade3bc2255a07c8157f.dl.dropboxusercontent.com
  • 162.125.66.6
malicious
flmates.com
  • 47.254.173.224
malicious

Threats

PID
Process
Class
Message
2796
iexplore.exe
Potential Corporate Privacy Violation
SUSPICIOUS [PTsecurity] Dropbox SSL Payload Request
3140
scan docs-file018374_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3140
scan docs-file018374_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
3140
scan docs-file018374_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
3140
scan docs-file018374_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
3140
scan docs-file018374_pdf.exe
A Network Trojan was detected
MALWARE [PTsecurity] Loki Bot Check-in M2
3140
scan docs-file018374_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3140
scan docs-file018374_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
3140
scan docs-file018374_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
3140
scan docs-file018374_pdf.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
5 ETPRO signatures available at the full report
No debug info