General
-
Target
910d4e264036f52b56c864e80360fed814b1baa8ef78f4361cf156e026c7b792.exe
-
Size
660KB
-
Sample
201020-yrzkqeqfp6
-
MD5
ac90765bd67bab9299ce515b424c7999
-
SHA1
e0345e6c98b210b667f07527906a913fa8af352d
-
SHA256
910d4e264036f52b56c864e80360fed814b1baa8ef78f4361cf156e026c7b792
-
SHA512
126af3208ec6e60a0d5588542b08c78f9cb534884257252c1f918dbb76a075134d04cc4893c9765f2b66e074a57de9a1220cfa0aad1fc7fade4d2655466f6494
Static task
static1
Behavioral task
behavioral1
Sample
910d4e264036f52b56c864e80360fed814b1baa8ef78f4361cf156e026c7b792.exe
Resource
win7
Malware Config
Extracted
lokibot
http://195.69.140.147/.op/cr.php/6We0YzNidcg3L
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
910d4e264036f52b56c864e80360fed814b1baa8ef78f4361cf156e026c7b792.exe
-
Size
660KB
-
MD5
ac90765bd67bab9299ce515b424c7999
-
SHA1
e0345e6c98b210b667f07527906a913fa8af352d
-
SHA256
910d4e264036f52b56c864e80360fed814b1baa8ef78f4361cf156e026c7b792
-
SHA512
126af3208ec6e60a0d5588542b08c78f9cb534884257252c1f918dbb76a075134d04cc4893c9765f2b66e074a57de9a1220cfa0aad1fc7fade4d2655466f6494
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-