General
- Target yqgfkacF46F6MMR.exe
- Size 1.0MB
- Sample201124-pwfk1pcpea
- SHA256 cafc8e94432ddeb1dab209f0dff728282ee7dc66d4ff4725ff8409eb3cf0c2e5
- MD5 280f1d0e4acb258ddd5dfe4863ca1e41
- SHA1 9e17a8031efb16a8404fa07b91a48073e9e59b79
- SHA512 24b502519d5fe24969e3c7b6fffe2b38d8f2810e255ca0119d9ab7020135bd296a7f10eb14a9cefa4b40388bef74798434d40d03cbe2898859078ad0c88cdb7b
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
yqgfkacF46F6MMR.exe
Resource
win7v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://legalpath.in/cc/Panel/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target yqgfkacF46F6MMR.exe
- Size 1.0MB
- SHA256 cafc8e94432ddeb1dab209f0dff728282ee7dc66d4ff4725ff8409eb3cf0c2e5
- MD5 280f1d0e4acb258ddd5dfe4863ca1e41
- SHA1 9e17a8031efb16a8404fa07b91a48073e9e59b79
- SHA512 24b502519d5fe24969e3c7b6fffe2b38d8f2810e255ca0119d9ab7020135bd296a7f10eb14a9cefa4b40388bef74798434d40d03cbe2898859078ad0c88cdb7b
- MD5 SHA1 SHA512
-
Suspicious use of SetThreadContext