General
-
Target
RFQQuote-REF MOITB102125083.xz
-
Size
258KB
-
Sample
211025-3yh7bahehm
-
MD5
284d1ead4867e9066f4e1774896dfea8
-
SHA1
c77fb718e21465ff425e3a75fd345c888bdcae9f
-
SHA256
ea2f5eb9d08b4220ca5a3481f8e72f0ff1fb61bd0f26658460a57a43ba78bfd5
-
SHA512
4facdf3f73f570e5d4a93ce6413d62c136e4ee0e9a2d876d988ce11f93597ac3ed3d48eda04bbf6e918a68e726069f302dad449b9383708f96165ec930b72df6
Static task
static1
Behavioral task
behavioral1
Sample
RFQQuote-REF MOITB102125083.exe
Resource
win7-en-20210920
Malware Config
Extracted
lokibot
https://ilyasautotech.com.au/totech/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
RFQQuote-REF MOITB102125083.exe
-
Size
284KB
-
MD5
bd55ccb6444a95ba739bd1cb4a437376
-
SHA1
851515cdb533624e21106b30853eccedcd9014e5
-
SHA256
2345d148f6c1402a74baecbe8139105a16a4751f73d8ddae54866d21d6c3145c
-
SHA512
e0470a36154069b77412d5ff4d4750f5d3cdd4470c09276e66ffd98d5516a80daae5905cd884324c602ef7930a250a9551b309919ebf10a55258755c93fe36cc
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-