General
-
Target
S358900.exe
-
Size
569KB
-
Sample
200709-m8wcvjpxfx
-
MD5
d3c020c6b33a8038b06117aa7f8806e4
-
SHA1
d254327ec1b4c484d431142eea0419da9fea9077
-
SHA256
a01ca3af701f733763f0aefb7b77fd6b6af89d58f154dbdb8e8dc0a4aebed446
-
SHA512
4a63e88f88ce0bc706a207ca46f5da51147ffa6029f20c16f0049f7048a28b7947aa32244842e9c46bc4cc3cadcdfcf523589a5d24ea91017e6c82f3d4ca5aca
Static task
static1
Behavioral task
behavioral1
Sample
S358900.exe
Resource
win7v200430
Malware Config
Extracted
lokibot
http://abidjiaintl.ml/sethr/logs/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
S358900.exe
-
Size
569KB
-
MD5
d3c020c6b33a8038b06117aa7f8806e4
-
SHA1
d254327ec1b4c484d431142eea0419da9fea9077
-
SHA256
a01ca3af701f733763f0aefb7b77fd6b6af89d58f154dbdb8e8dc0a4aebed446
-
SHA512
4a63e88f88ce0bc706a207ca46f5da51147ffa6029f20c16f0049f7048a28b7947aa32244842e9c46bc4cc3cadcdfcf523589a5d24ea91017e6c82f3d4ca5aca
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-