General
-
Target
72de2d15c3b649b0d1f328c48295452584bd16bc947c2a33382c0db253d37842
-
Size
248KB
-
Sample
211025-hrbhnsgfej
-
MD5
252cb7750f2222daa043e7df88c1b160
-
SHA1
f817b0a167a6de21637c0124569484bcfb8e0257
-
SHA256
72de2d15c3b649b0d1f328c48295452584bd16bc947c2a33382c0db253d37842
-
SHA512
0142802303b28f2e19d0b552e1c8d85889a826e519949a48fd4846b80cb85dcfe717d5e24d5e7b940f983a1b39b0181250b9ccf014b68a8f0abe05c676afe356
Static task
static1
Malware Config
Extracted
lokibot
http://63.250.40.204/~wpdemo/file.php?search=719442
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
72de2d15c3b649b0d1f328c48295452584bd16bc947c2a33382c0db253d37842
-
Size
248KB
-
MD5
252cb7750f2222daa043e7df88c1b160
-
SHA1
f817b0a167a6de21637c0124569484bcfb8e0257
-
SHA256
72de2d15c3b649b0d1f328c48295452584bd16bc947c2a33382c0db253d37842
-
SHA512
0142802303b28f2e19d0b552e1c8d85889a826e519949a48fd4846b80cb85dcfe717d5e24d5e7b940f983a1b39b0181250b9ccf014b68a8f0abe05c676afe356
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-