General
- Target vbc.exe
- Size 741KB
- Sample201103-dlhe35b266
- SHA256 9ebe51e383ea0bdd41359e085172e6555e9f7e24cae16c128f84b8def85f48ad
- MD5 c3625ccbd503205305fbee104c373165
- SHA1 fa9672023268a4f6bee24d9c78dd21af2f3c7c7e
- SHA512 fa09c8029b28a3e51d4144685196580be398db2509a16557f7e4d99f6cec92969f7da951ea0f58728b2f81a9d57c72b82cbba66b222c0f04b166e4434e29c91e
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://195.69.140.147/.op/cr.php/NCTxXyKTcBIUf
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target vbc.exe
- Size 741KB
- SHA256 9ebe51e383ea0bdd41359e085172e6555e9f7e24cae16c128f84b8def85f48ad
- MD5 c3625ccbd503205305fbee104c373165
- SHA1 fa9672023268a4f6bee24d9c78dd21af2f3c7c7e
- SHA512 fa09c8029b28a3e51d4144685196580be398db2509a16557f7e4d99f6cec92969f7da951ea0f58728b2f81a9d57c72b82cbba66b222c0f04b166e4434e29c91e
- MD5 SHA1 SHA512
Score10/10-
Uses the VBS compiler for execution
-
Modifies service
-
Suspicious use of SetThreadContext