General
- Target 9364b232d5ef553f6df20e977e1a9ca2.exe
- Size 1.2MB
- Sample201109-wcwpde34jn
- SHA256 e34ea10e33cac3cd7e82feb163446f1fbbff7c024eafcfd330e62e66f285062d
- MD5 9364b232d5ef553f6df20e977e1a9ca2
- SHA1 dc4ca2f316580b02e9a027606dc2087475aa3724
- SHA512 58e579f506619034092e3ebf6057e2ca328b79c61d9d39983a135e17c615de2dcc5d0e3c34a1adaa3626034eb2d64597b6bda032549dc139fd17bd5a6984cce5
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
9364b232d5ef553f6df20e977e1a9ca2.exe
Resource
win7v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://zangs.ga/choolee/gate.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target 9364b232d5ef553f6df20e977e1a9ca2.exe
- Size 1.2MB
- SHA256 e34ea10e33cac3cd7e82feb163446f1fbbff7c024eafcfd330e62e66f285062d
- MD5 9364b232d5ef553f6df20e977e1a9ca2
- SHA1 dc4ca2f316580b02e9a027606dc2087475aa3724
- SHA512 58e579f506619034092e3ebf6057e2ca328b79c61d9d39983a135e17c615de2dcc5d0e3c34a1adaa3626034eb2d64597b6bda032549dc139fd17bd5a6984cce5
- MD5 SHA1 SHA512
-
Suspicious use of SetThreadContext