General
-
Target
1264a71074a9c7b6e582a466b7b2d6c0fbfd6e04212a72bf75349b7c6e1b43c4.exe
-
Size
547KB
-
Sample
210727-x8lz7z6zax
-
MD5
fce02d5ae70e73ef9e8d23fbc58c4796
-
SHA1
ee387ebd9710923fd37b16366c009848013701d4
-
SHA256
1264a71074a9c7b6e582a466b7b2d6c0fbfd6e04212a72bf75349b7c6e1b43c4
-
SHA512
8a317f6f9d9b9ac41766e1b28381ab84c0cb0e14a438210db1b7f6b822e2bf3c433737d9cc597c74c20fcde5e3706981faebc10f6c1e777563cd138fcee011a6
Static task
static1
Behavioral task
behavioral1
Sample
1264a71074a9c7b6e582a466b7b2d6c0fbfd6e04212a72bf75349b7c6e1b43c4.exe
Resource
win7v20210410
Malware Config
Extracted
lokibot
http://ccjjlogsx.com/uu/me/ii.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
1264a71074a9c7b6e582a466b7b2d6c0fbfd6e04212a72bf75349b7c6e1b43c4.exe
-
Size
547KB
-
MD5
fce02d5ae70e73ef9e8d23fbc58c4796
-
SHA1
ee387ebd9710923fd37b16366c009848013701d4
-
SHA256
1264a71074a9c7b6e582a466b7b2d6c0fbfd6e04212a72bf75349b7c6e1b43c4
-
SHA512
8a317f6f9d9b9ac41766e1b28381ab84c0cb0e14a438210db1b7f6b822e2bf3c433737d9cc597c74c20fcde5e3706981faebc10f6c1e777563cd138fcee011a6
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Suspicious use of SetThreadContext
-