General
- Target d6c5ee5d5d15bd26a18c40fcbca463c9.exe
- Size 446KB
- Sample201110-856d9lxdc6
- SHA256 5644995ecaa8691d9db3cdd76c00fa36cd4c198ad7e22ddf58d39ca637f99e45
- MD5 d6c5ee5d5d15bd26a18c40fcbca463c9
- SHA1 83fcbc2dc749f2c6cb8ece9199efd53ec45d2ec2
- SHA512 c1fcc249cf0c05fb22e7b0316c00bf0266573917994917134bf62ec908b7e5e192d5c14a4b7ecd96a1a08685afdc967987ac64092c47944363d4e3c78d35ad88
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
d6c5ee5d5d15bd26a18c40fcbca463c9.exe
Resource
win7v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://magicview.ga/ibiki/gate.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target d6c5ee5d5d15bd26a18c40fcbca463c9.exe
- Size 446KB
- SHA256 5644995ecaa8691d9db3cdd76c00fa36cd4c198ad7e22ddf58d39ca637f99e45
- MD5 d6c5ee5d5d15bd26a18c40fcbca463c9
- SHA1 83fcbc2dc749f2c6cb8ece9199efd53ec45d2ec2
- SHA512 c1fcc249cf0c05fb22e7b0316c00bf0266573917994917134bf62ec908b7e5e192d5c14a4b7ecd96a1a08685afdc967987ac64092c47944363d4e3c78d35ad88
- MD5 SHA1 SHA512
Score10/10-
Modifies service
-
Suspicious use of SetThreadContext