General
-
Target
f261e6699cf2c762ffc153203e99ac2fab25a21af25e4a17558562531a5c0faa.exe
-
Size
551KB
-
Sample
210728-4e9fb1y6re
-
MD5
6f91a99c25ae0ba4dbfc5fe127c7ee36
-
SHA1
1dba39475d7a4279009b87b117f683c398f8245b
-
SHA256
f261e6699cf2c762ffc153203e99ac2fab25a21af25e4a17558562531a5c0faa
-
SHA512
f30ba3955310d05962e4611061ac88e354d9af83a81619303346c845f8c6fff5b25add2f137f0235270be7f3f43b3df3832c893199caa57233ca35edcb4674d4
Static task
static1
Behavioral task
behavioral1
Sample
f261e6699cf2c762ffc153203e99ac2fab25a21af25e4a17558562531a5c0faa.exe
Resource
win7v20210410
Malware Config
Extracted
lokibot
http://zascocs.xyz/cd/ui/fo.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
f261e6699cf2c762ffc153203e99ac2fab25a21af25e4a17558562531a5c0faa.exe
-
Size
551KB
-
MD5
6f91a99c25ae0ba4dbfc5fe127c7ee36
-
SHA1
1dba39475d7a4279009b87b117f683c398f8245b
-
SHA256
f261e6699cf2c762ffc153203e99ac2fab25a21af25e4a17558562531a5c0faa
-
SHA512
f30ba3955310d05962e4611061ac88e354d9af83a81619303346c845f8c6fff5b25add2f137f0235270be7f3f43b3df3832c893199caa57233ca35edcb4674d4
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Suspicious use of SetThreadContext
-