General
-
Target
f184c7be5715b6cee3458d2b830788cf
-
Size
263KB
-
Sample
211025-j2pzgsggej
-
MD5
f184c7be5715b6cee3458d2b830788cf
-
SHA1
83134dbda0337c6f5a41773b6d430bd227b4d6bf
-
SHA256
c2853161b03051757ee439842cf28a6526872c9898183a21deeb7fca109e4ff6
-
SHA512
4e89ae3793afd18a79c94a7cdddcbbea2122f5c133e7b6f30960b7076343325df4c2fb72b9a0f8e06c3dc4d70831d7b3f97db04a33eb32988babefa9d8254bbb
Static task
static1
Behavioral task
behavioral1
Sample
f184c7be5715b6cee3458d2b830788cf.exe
Resource
win7-en-20210920
Malware Config
Extracted
lokibot
http://bobbyelectronics.xyz/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
f184c7be5715b6cee3458d2b830788cf
-
Size
263KB
-
MD5
f184c7be5715b6cee3458d2b830788cf
-
SHA1
83134dbda0337c6f5a41773b6d430bd227b4d6bf
-
SHA256
c2853161b03051757ee439842cf28a6526872c9898183a21deeb7fca109e4ff6
-
SHA512
4e89ae3793afd18a79c94a7cdddcbbea2122f5c133e7b6f30960b7076343325df4c2fb72b9a0f8e06c3dc4d70831d7b3f97db04a33eb32988babefa9d8254bbb
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-