General
-
Target
cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
-
Size
536KB
-
Sample
210728-bp8x74em4s
-
MD5
2402f165befaa33e3700592cb7defe4c
-
SHA1
e1c0b072bf018dc8af85ff4972a7e0718a4c7bf7
-
SHA256
cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3
-
SHA512
ff5f1dac40696ba5875abd8baad70b6b5c2fad8485530c6a09217c5d1ce9cd57b761861aa4d07998b13f12f85353336332649b3b6fa036489cd95d8a5a89e322
Static task
static1
Behavioral task
behavioral1
Sample
cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
Resource
win7v20210410
Malware Config
Extracted
lokibot
https://luoslasco.xyz/to/ya/vd.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3.exe
-
Size
536KB
-
MD5
2402f165befaa33e3700592cb7defe4c
-
SHA1
e1c0b072bf018dc8af85ff4972a7e0718a4c7bf7
-
SHA256
cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3
-
SHA512
ff5f1dac40696ba5875abd8baad70b6b5c2fad8485530c6a09217c5d1ce9cd57b761861aa4d07998b13f12f85353336332649b3b6fa036489cd95d8a5a89e322
-
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Suspicious use of SetThreadContext
-