General
- Target proforma invoice.exe
- Size 732KB
- Sample210618-12hdpgcklj
- SHA256 3e56d9df1d14f5758330600d1d2fd098a173842fae0447bdf8e6d97a4d2c7162
- MD5 32da26fcfe5bc84fd3cb8f4fe253d1bc
- SHA1 fe115845cbf59d00d4152016b1544f6cff21fb05
- SHA512 aab80141857c9b7000b73251f4c75c9798332e5b693c75d1fbc8928159fee48597c7f72c713034f212bcc224642da0f242e561251c5b16a672300ec1f79b4c1f
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
proforma invoice.exe
Resource
win7v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://manvim.co/bo/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target proforma invoice.exe
- Size 732KB
- SHA256 3e56d9df1d14f5758330600d1d2fd098a173842fae0447bdf8e6d97a4d2c7162
- MD5 32da26fcfe5bc84fd3cb8f4fe253d1bc
- SHA1 fe115845cbf59d00d4152016b1544f6cff21fb05
- SHA512 aab80141857c9b7000b73251f4c75c9798332e5b693c75d1fbc8928159fee48597c7f72c713034f212bcc224642da0f242e561251c5b16a672300ec1f79b4c1f
- MD5 SHA1 SHA512
-
Suspicious use of SetThreadContext