General
-
Target
Factura comercial.exe
-
Size
556KB
-
Sample
210727-f97gp1j5j6
-
MD5
0d4b6d93b2c7624ac7ba28315445380a
-
SHA1
df99bf7d6297a448aa27e4c6e5676d0a1b43a5c4
-
SHA256
5ed35d6d4d4045dddaba338ea5d2858a699e1cafa80077151ad6d2923121af8e
-
SHA512
a29d3b067e136cafd9d5513f1ffebf74e2152ed78c6c6cde7a544a895fcfe5d2447a29809e9a2f8bf5388b5dcaed59ac9a124c5f1c19e2d9b994c05586d5dfd9
Static task
static1
Behavioral task
behavioral1
Sample
Factura comercial.exe
Resource
win7v20210410
Malware Config
Extracted
lokibot
https://pakilogs2020.xyz/t/e/ff.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Factura comercial.exe
-
Size
556KB
-
MD5
0d4b6d93b2c7624ac7ba28315445380a
-
SHA1
df99bf7d6297a448aa27e4c6e5676d0a1b43a5c4
-
SHA256
5ed35d6d4d4045dddaba338ea5d2858a699e1cafa80077151ad6d2923121af8e
-
SHA512
a29d3b067e136cafd9d5513f1ffebf74e2152ed78c6c6cde7a544a895fcfe5d2447a29809e9a2f8bf5388b5dcaed59ac9a124c5f1c19e2d9b994c05586d5dfd9
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Suspicious use of SetThreadContext
-