General
-
Target
be59bb982d061c5820c60c54b18b86ef6b58f0c503b0235c7fd8dc1af3caf59a.exe
-
Size
595KB
-
Sample
200529-9qh65sw4wn
-
MD5
0f8cd28f6635d31a37215a78bf045668
-
SHA1
c3f56940372eed5c164061b11203146c398d85b0
-
SHA256
be59bb982d061c5820c60c54b18b86ef6b58f0c503b0235c7fd8dc1af3caf59a
-
SHA512
4dc47cd56fb9c2b5fbff4983afbce6fe85694c949c090cc7aee3dcd92c6f0aaae7708effcca419c166feb5b8a94718f53b21791f16ebe9e0bd17ff123dc9c27f
Static task
static1
Behavioral task
behavioral1
Sample
be59bb982d061c5820c60c54b18b86ef6b58f0c503b0235c7fd8dc1af3caf59a.exe
Resource
win7v200430
Malware Config
Extracted
lokibot
http://superson.ga/Arinze/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
be59bb982d061c5820c60c54b18b86ef6b58f0c503b0235c7fd8dc1af3caf59a.exe
-
Size
595KB
-
MD5
0f8cd28f6635d31a37215a78bf045668
-
SHA1
c3f56940372eed5c164061b11203146c398d85b0
-
SHA256
be59bb982d061c5820c60c54b18b86ef6b58f0c503b0235c7fd8dc1af3caf59a
-
SHA512
4dc47cd56fb9c2b5fbff4983afbce6fe85694c949c090cc7aee3dcd92c6f0aaae7708effcca419c166feb5b8a94718f53b21791f16ebe9e0bd17ff123dc9c27f
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-