General
-
Target
Tax Receipts.xlsx
-
Size
369KB
-
Sample
211021-wlbhdabebj
-
MD5
bfcb6ecc43e9babe0ec5c17079353890
-
SHA1
e74276419e06d32ce456a8a44fe801ecd24fbfa4
-
SHA256
fce258aaff67f1ebf4c69bf8f19d48771428a983ef9c2b8811664a40f3d80cbf
-
SHA512
0340ae2f1901daf2298f81d2e56443b368bdbcf702f226543853b311c86f13ce310c804ce8b1135db607d5a9e39613c57aac0d0bc96b4e22a1300464214870d2
Static task
static1
Behavioral task
behavioral1
Sample
Tax Receipts.xlsx
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Tax Receipts.xlsx
Resource
win10-en-20210920
Malware Config
Extracted
lokibot
http://63.250.40.204/~wpdemo/file.php?search=386869
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Tax Receipts.xlsx
-
Size
369KB
-
MD5
bfcb6ecc43e9babe0ec5c17079353890
-
SHA1
e74276419e06d32ce456a8a44fe801ecd24fbfa4
-
SHA256
fce258aaff67f1ebf4c69bf8f19d48771428a983ef9c2b8811664a40f3d80cbf
-
SHA512
0340ae2f1901daf2298f81d2e56443b368bdbcf702f226543853b311c86f13ce310c804ce8b1135db607d5a9e39613c57aac0d0bc96b4e22a1300464214870d2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-