General
-
Target
AVH3viH4ec3ZkIM.exe
-
Size
574KB
-
Sample
210727-4tsqlk9fqx
-
MD5
fbce581748b0bc085cf3742c7f4e5859
-
SHA1
a624dd7766eab090e47ae0d97de8d7ef2dd0440c
-
SHA256
c9f200f2d880906c47c6a9c36a16b7a42851e62b27d531f7066651b6932a7aa6
-
SHA512
912ba02f3ddc00c82d1bf495dac086cc3d5d67c27aa184045131b32c1f832bd1bab3854845858e16c11f8f1b09b11e2c43cc5ea59b3750203aab11c3bae01a2a
Static task
static1
Behavioral task
behavioral1
Sample
AVH3viH4ec3ZkIM.exe
Resource
win7v20210408
Malware Config
Extracted
lokibot
http://185.227.139.18/dsaicosaicasdi.php/4VhkXKQmUI30m
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
AVH3viH4ec3ZkIM.exe
-
Size
574KB
-
MD5
fbce581748b0bc085cf3742c7f4e5859
-
SHA1
a624dd7766eab090e47ae0d97de8d7ef2dd0440c
-
SHA256
c9f200f2d880906c47c6a9c36a16b7a42851e62b27d531f7066651b6932a7aa6
-
SHA512
912ba02f3ddc00c82d1bf495dac086cc3d5d67c27aa184045131b32c1f832bd1bab3854845858e16c11f8f1b09b11e2c43cc5ea59b3750203aab11c3bae01a2a
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Suspicious use of SetThreadContext
-