General
-
Target
704c79f08835a93bc64bdb960c63dfa849a4c0fd5867255522d01a57eb979293.exe
-
Size
370KB
-
Sample
211021-wm3cgsbebq
-
MD5
1f0a0de6491ff5fb6c2e095a9104777b
-
SHA1
3d4957efef2f8f1570853e4e9468134ef5be1787
-
SHA256
704c79f08835a93bc64bdb960c63dfa849a4c0fd5867255522d01a57eb979293
-
SHA512
33915cfce235d783430b9377a3c194610fddca871edba4547b9c04452dba3fe09dbf61ca80ffc9ce0b00b780c8ce72fbcb53de08b4283a7f46c2d6860b69511e
Static task
static1
Behavioral task
behavioral1
Sample
704c79f08835a93bc64bdb960c63dfa849a4c0fd5867255522d01a57eb979293.exe
Resource
win7-en-20210920
Malware Config
Extracted
lokibot
http://63.250.40.204/~wpdemo/file.php?search=475803
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
704c79f08835a93bc64bdb960c63dfa849a4c0fd5867255522d01a57eb979293.exe
-
Size
370KB
-
MD5
1f0a0de6491ff5fb6c2e095a9104777b
-
SHA1
3d4957efef2f8f1570853e4e9468134ef5be1787
-
SHA256
704c79f08835a93bc64bdb960c63dfa849a4c0fd5867255522d01a57eb979293
-
SHA512
33915cfce235d783430b9377a3c194610fddca871edba4547b9c04452dba3fe09dbf61ca80ffc9ce0b00b780c8ce72fbcb53de08b4283a7f46c2d6860b69511e
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-