General
-
Target
ef9f101dde3bdcfdb7e80989c152290d02a58a9853804fb7b691343b1d18cd5b.exe
-
Size
1.0MB
-
Sample
210727-z6h3v8wx2x
-
MD5
9f58c3a016972b23245035213c2d914c
-
SHA1
35bc5fc2b0a11ac1f96240b0016d01951c979500
-
SHA256
ef9f101dde3bdcfdb7e80989c152290d02a58a9853804fb7b691343b1d18cd5b
-
SHA512
4af330abc090b3ff0969950084f48d1b83f3182220763a79f28d514e63b6feabf533928dc782ec02c2a5aa1f6be1363aa231276197babc1a9f4b409c330da251
Static task
static1
Behavioral task
behavioral1
Sample
ef9f101dde3bdcfdb7e80989c152290d02a58a9853804fb7b691343b1d18cd5b.exe
Resource
win7v20210410
Malware Config
Extracted
lokibot
http://manvim.co/fd3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
ef9f101dde3bdcfdb7e80989c152290d02a58a9853804fb7b691343b1d18cd5b.exe
-
Size
1.0MB
-
MD5
9f58c3a016972b23245035213c2d914c
-
SHA1
35bc5fc2b0a11ac1f96240b0016d01951c979500
-
SHA256
ef9f101dde3bdcfdb7e80989c152290d02a58a9853804fb7b691343b1d18cd5b
-
SHA512
4af330abc090b3ff0969950084f48d1b83f3182220763a79f28d514e63b6feabf533928dc782ec02c2a5aa1f6be1363aa231276197babc1a9f4b409c330da251
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Suspicious use of SetThreadContext
-