General
- Target 3ffe0bc9e3a2390ea85d60eb624f9369.exe
- Size 199KB
- Sample211012-mas4lscaer
- SHA256 895a3f8a366ed73ca1cab8ef49582ada6382880654ab28e95b2902cde46e3726
- MD5 3ffe0bc9e3a2390ea85d60eb624f9369
- SHA1 f31b6ce7c4551844b48ecea8c2593c52fd0da89e
- SHA512 f3834dbd1337281d29646640de98477f52a2bba4005040d4b78ba74d7072532367caf31cd29b8b2cf80f3bfebf73c54605a67587795fce6b1e485b33d96b786c
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
3ffe0bc9e3a2390ea85d60eb624f9369.exe
Resource
win7-en-20210920
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://checkvim.com/fd4/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target 3ffe0bc9e3a2390ea85d60eb624f9369.exe
- Size 199KB
- SHA256 895a3f8a366ed73ca1cab8ef49582ada6382880654ab28e95b2902cde46e3726
- MD5 3ffe0bc9e3a2390ea85d60eb624f9369
- SHA1 f31b6ce7c4551844b48ecea8c2593c52fd0da89e
- SHA512 f3834dbd1337281d29646640de98477f52a2bba4005040d4b78ba74d7072532367caf31cd29b8b2cf80f3bfebf73c54605a67587795fce6b1e485b33d96b786c
- MD5 SHA1 SHA512
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
Accesses Microsoft Outlook profiles