General
-
Target
wT68Fevuk5oozkl.exe
-
Size
557KB
-
Sample
200709-psr7k4pcxs
-
MD5
fc5cd5a5634e0278a26c917a4d35e6cb
-
SHA1
947a2b235f0931d7dbae5ae7e191787e206f7628
-
SHA256
e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117
-
SHA512
feb93650e811bf601f33850a0def95b436ce1677172e3a257492e28159506b7ee7c586a42c1ad8d37555ec6ac2371fd12c451732a16fbb9c403af5e0ad3201f5
Static task
static1
Behavioral task
behavioral1
Sample
wT68Fevuk5oozkl.exe
Resource
win7
Behavioral task
behavioral2
Sample
wT68Fevuk5oozkl.exe
Resource
win10v200430
Malware Config
Extracted
lokibot
http://emirate-net.me/ig1/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
wT68Fevuk5oozkl.exe
-
Size
557KB
-
MD5
fc5cd5a5634e0278a26c917a4d35e6cb
-
SHA1
947a2b235f0931d7dbae5ae7e191787e206f7628
-
SHA256
e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117
-
SHA512
feb93650e811bf601f33850a0def95b436ce1677172e3a257492e28159506b7ee7c586a42c1ad8d37555ec6ac2371fd12c451732a16fbb9c403af5e0ad3201f5
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-