General
- Target swift copy.exe
- Size 603KB
- Sample210602-gbespcnxt2
- SHA256 68d8eb06567fcf2d89595c4cef65212cb05c6bade4f14d9b013f2d457393bb32
- MD5 1d51b054f287bdb2098791d9c02cb080
- SHA1 ca5884cb2cba181dbd439bf0a5e445a6e48a14b6
- SHA512 bff3656eb1d6e7cf2dc0a4e28b5df7a814b8fd47bf5be92d1be4ccf1ba32d70b90d2d40afcad49cd0922b080a9af8026aed02e7a75929fcdb70d3234e140feb0
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
swift copy.exe
Resource
win7v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://manvim.co/fc5/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target swift copy.exe
- Size 603KB
- SHA256 68d8eb06567fcf2d89595c4cef65212cb05c6bade4f14d9b013f2d457393bb32
- MD5 1d51b054f287bdb2098791d9c02cb080
- SHA1 ca5884cb2cba181dbd439bf0a5e445a6e48a14b6
- SHA512 bff3656eb1d6e7cf2dc0a4e28b5df7a814b8fd47bf5be92d1be4ccf1ba32d70b90d2d40afcad49cd0922b080a9af8026aed02e7a75929fcdb70d3234e140feb0
- MD5 SHA1 SHA512
Suspicious use of SetThreadContext