General
-
Target
Invoice PG 008946.xlsx
-
Size
1.2MB
-
Sample
210726-gzejtlhqle
-
MD5
84ea29c7d6a9ed32225d28bb8f54aa9c
-
SHA1
c75c6394dfa978671c5ed147ce93a2beec1f097d
-
SHA256
66896b1e0185fe478676b2efc089442230577e7b7b3d62eed4604adbe829f8d9
-
SHA512
9bf2f046d7dc821df3342b072ace1ebf5321af72807a4e0100df4fd698e4d2e9459690a987437779493544c9c4dff1332b2332958a36022ab4c54a0cd3946432
Static task
static1
Behavioral task
behavioral1
Sample
Invoice PG 008946.xlsx
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Invoice PG 008946.xlsx
Resource
win10v20210408
Malware Config
Extracted
lokibot
http://185.227.139.18/dsaicosaicasdi.php/jRbn3g7uWVTsx
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Invoice PG 008946.xlsx
-
Size
1.2MB
-
MD5
84ea29c7d6a9ed32225d28bb8f54aa9c
-
SHA1
c75c6394dfa978671c5ed147ce93a2beec1f097d
-
SHA256
66896b1e0185fe478676b2efc089442230577e7b7b3d62eed4604adbe829f8d9
-
SHA512
9bf2f046d7dc821df3342b072ace1ebf5321af72807a4e0100df4fd698e4d2e9459690a987437779493544c9c4dff1332b2332958a36022ab4c54a0cd3946432
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-