General
- Target 9194a15c419ca38f3a7801503b8650ea.exe
- Size 496KB
- Sample201210-88p7chzkej
- SHA256 d62ddaa338082bfaaa7ca4806e395729c140bc21737f2d75d779801ce4f900c6
- MD5 9194a15c419ca38f3a7801503b8650ea
- SHA1 861059115e345f458e6420eb0de045e70ece004b
- SHA512 c859b607be7f7b20c1e347f9e69e3a4c6657bdf84b77252fbda67f397684cbd9d342e6fc8ccaa0a6c03c00b7ce49a557fc3b2edc4cb20c87c408334d654d59ad
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
9194a15c419ca38f3a7801503b8650ea.exe
Resource
win7v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://begadi.ga/clue/gate.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target 9194a15c419ca38f3a7801503b8650ea.exe
- Size 496KB
- SHA256 d62ddaa338082bfaaa7ca4806e395729c140bc21737f2d75d779801ce4f900c6
- MD5 9194a15c419ca38f3a7801503b8650ea
- SHA1 861059115e345f458e6420eb0de045e70ece004b
- SHA512 c859b607be7f7b20c1e347f9e69e3a4c6657bdf84b77252fbda67f397684cbd9d342e6fc8ccaa0a6c03c00b7ce49a557fc3b2edc4cb20c87c408334d654d59ad
- MD5 SHA1 SHA512
-
Suspicious use of SetThreadContext