General
-
Target
32894ea1274b19405c61b1ef24059a7e6b2854984a4c5ab6f349899ba64696ff.exe
-
Size
393KB
-
Sample
210727-ff4np1pgns
-
MD5
4d85e6c70760761a009957e9db240df0
-
SHA1
729128422d7b4c6939f13a4f9f19b72976222a01
-
SHA256
32894ea1274b19405c61b1ef24059a7e6b2854984a4c5ab6f349899ba64696ff
-
SHA512
acac07d01c08eec2e9d65642acc2ff7b9f850f30d753f16c9081826834e7f8282e9ef1109d1129e8f9cc6c176a430daf8fafced964825820027d958010ecf6eb
Static task
static1
Behavioral task
behavioral1
Sample
32894ea1274b19405c61b1ef24059a7e6b2854984a4c5ab6f349899ba64696ff.exe
Resource
win7v20210410
Malware Config
Extracted
lokibot
http://ccjjlogsx.com/uu/me/ii.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
32894ea1274b19405c61b1ef24059a7e6b2854984a4c5ab6f349899ba64696ff.exe
-
Size
393KB
-
MD5
4d85e6c70760761a009957e9db240df0
-
SHA1
729128422d7b4c6939f13a4f9f19b72976222a01
-
SHA256
32894ea1274b19405c61b1ef24059a7e6b2854984a4c5ab6f349899ba64696ff
-
SHA512
acac07d01c08eec2e9d65642acc2ff7b9f850f30d753f16c9081826834e7f8282e9ef1109d1129e8f9cc6c176a430daf8fafced964825820027d958010ecf6eb
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Suspicious use of SetThreadContext
-