lokibot[.]doc[.]zip | Triage

Sharing

General

Target

lokibot.doc.zip
Size

2.2MB
MD5

ab32d4c4901ac6f60b48a92b486290ec
SHA1

7dcdd8b33c81d57f913ab63824b06349a4a42c25
SHA256

d7bf92f0d786e8e83d58ea0925a6c8619f08d2e823717953cdebcc1ee716e3e7
SHA512

32accf33bd0e8bf449fa6d29433bddbf6591c89ce69e91901e0b433f9faf8e09b5202a68015fb314bea1a14259bf46d121b375eafe7c31e00c940a8c39d1e1df

Score

8^/10

macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
static1/unpack001/lokibot.doc	office_macro_on_action

Files

lokibot.doc.zip
.zip

Password: infected
lokibot.doc
.doc windows office2003

ThisDocument

culex