General
- Target 3CA86B064F7A59EA99EC5E7B30AAD3C0.exe
- Size 690KB
- Sample210703-zbj4clzpg2
- SHA256 96502f45d9fa8235052025a0edfb89ce841b2b188259c870626f499ed68116a9
- MD5 3ca86b064f7a59ea99ec5e7b30aad3c0
- SHA1 0cd88be35ba015193a9b9b2a3ac0e8f2c1c14026
- SHA512 68fd86a82fec532270449c2c1ad06a6036924739aee0d58a27c2dc6b35423f7d7990382e8cac89b1ac0184ab7e63b8bf6d4f60abd16f6f904c3fa557c2ec5b7d
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
3CA86B064F7A59EA99EC5E7B30AAD3C0.exe
Resource
win7v20210408
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://mahetechasia.com/data/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target 3CA86B064F7A59EA99EC5E7B30AAD3C0.exe
- Size 690KB
- SHA256 96502f45d9fa8235052025a0edfb89ce841b2b188259c870626f499ed68116a9
- MD5 3ca86b064f7a59ea99ec5e7b30aad3c0
- SHA1 0cd88be35ba015193a9b9b2a3ac0e8f2c1c14026
- SHA512 68fd86a82fec532270449c2c1ad06a6036924739aee0d58a27c2dc6b35423f7d7990382e8cac89b1ac0184ab7e63b8bf6d4f60abd16f6f904c3fa557c2ec5b7d
- MD5 SHA1 SHA512
-
Suspicious use of SetThreadContext