General
-
Target
PO99817581.exe
-
Size
179KB
-
Sample
211029-fppleahcfn
-
MD5
29078dbe726973e076f4391f7f495df0
-
SHA1
ec2852af48bc42dac2c0677f2ddde12d6b791a19
-
SHA256
450b24cbbef66abf47379692556145f7816ee0ace220d552963b34bff393fa61
-
SHA512
0c08bd9159cfe5e539f036ee77fb939db3bc9f03cf3e1068a52a17b4ea81775542827c47b38a25fe47f1c23e391ad296af8a01da5671681ac7772214ad469988
Static task
static1
Behavioral task
behavioral1
Sample
PO99817581.exe
Resource
win7-en-20210920
Malware Config
Extracted
lokibot
http://203.159.80.151/king/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
PO99817581.exe
-
Size
179KB
-
MD5
29078dbe726973e076f4391f7f495df0
-
SHA1
ec2852af48bc42dac2c0677f2ddde12d6b791a19
-
SHA256
450b24cbbef66abf47379692556145f7816ee0ace220d552963b34bff393fa61
-
SHA512
0c08bd9159cfe5e539f036ee77fb939db3bc9f03cf3e1068a52a17b4ea81775542827c47b38a25fe47f1c23e391ad296af8a01da5671681ac7772214ad469988
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-