General
-
Target
96d98cb124bae466e84cad1325dc8fbcbefb44c83efb67231c886a4f0cf6bbaf
-
Size
245KB
-
Sample
211021-1ah6asbfeq
-
MD5
d4a99da8dad738056893d74202045a0a
-
SHA1
8dce612affbacd3ce2d3736dba594e8af4649ed4
-
SHA256
96d98cb124bae466e84cad1325dc8fbcbefb44c83efb67231c886a4f0cf6bbaf
-
SHA512
d124289eaadc29900440573ecf30de9ac19e9fbaa9952b972c2d0e67a3d6da537a7fd188894ce220390a00ef2de24592247add821ccef34d12a4ba37d832561e
Static task
static1
Malware Config
Extracted
lokibot
http://74f26d34ffff049368a6cff8812f86ee.ml/BN22/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
96d98cb124bae466e84cad1325dc8fbcbefb44c83efb67231c886a4f0cf6bbaf
-
Size
245KB
-
MD5
d4a99da8dad738056893d74202045a0a
-
SHA1
8dce612affbacd3ce2d3736dba594e8af4649ed4
-
SHA256
96d98cb124bae466e84cad1325dc8fbcbefb44c83efb67231c886a4f0cf6bbaf
-
SHA512
d124289eaadc29900440573ecf30de9ac19e9fbaa9952b972c2d0e67a3d6da537a7fd188894ce220390a00ef2de24592247add821ccef34d12a4ba37d832561e
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-