General
- Target 76afce42f708e6a32dc9d0e52f9f0336
- Size 1.2MB
- Sample210622-a3ct5cb87x
- SHA256 9e658eb8027169730ef306e2e3b145dd71c9d9f569ce7dd7c8264a0dfc114d87
- MD5 76afce42f708e6a32dc9d0e52f9f0336
- SHA1 d7a3d05c161bcfdafe6348d82672d011fc5b05cc
- SHA512 db66f324d80d2cbe1dc9b0fd7ccdeed896ed5e4e08c4e837542d27371ab05befdb43dfb46655ef725aba3b3a6582be908da5a6d44bdde7900977520eb355e3d9
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
76afce42f708e6a32dc9d0e52f9f0336.exe
Resource
win7v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://63.141.228.141/32.php/QQojJUjm8ByeT
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target 76afce42f708e6a32dc9d0e52f9f0336
- Size 1.2MB
- SHA256 9e658eb8027169730ef306e2e3b145dd71c9d9f569ce7dd7c8264a0dfc114d87
- MD5 76afce42f708e6a32dc9d0e52f9f0336
- SHA1 d7a3d05c161bcfdafe6348d82672d011fc5b05cc
- SHA512 db66f324d80d2cbe1dc9b0fd7ccdeed896ed5e4e08c4e837542d27371ab05befdb43dfb46655ef725aba3b3a6582be908da5a6d44bdde7900977520eb355e3d9
- MD5 SHA1 SHA512
-
Suspicious use of SetThreadContext