General
-
Target
6d1cfe521f8ec86635395600f0fe5d40678e789380efbce873f191b67ea015ab
-
Size
540KB
-
Sample
211029-wh726saebk
-
MD5
e955bd8d18d22dd108fb7d26c3a042bd
-
SHA1
3ee646b49da8b451b2adcf6211e67db2ef0a1d1a
-
SHA256
6d1cfe521f8ec86635395600f0fe5d40678e789380efbce873f191b67ea015ab
-
SHA512
76c4a002291dbbb972c71e99bad7510ad3e3dbacb76dbddb540a14b2410c46059570176292cd75f5c23cc8c6c5d100d49e59d624b0b64713df9c921687278c94
Static task
static1
Malware Config
Extracted
lokibot
http://63.250.40.204/~wpdemo/file.php?search=9099522
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
6d1cfe521f8ec86635395600f0fe5d40678e789380efbce873f191b67ea015ab
-
Size
540KB
-
MD5
e955bd8d18d22dd108fb7d26c3a042bd
-
SHA1
3ee646b49da8b451b2adcf6211e67db2ef0a1d1a
-
SHA256
6d1cfe521f8ec86635395600f0fe5d40678e789380efbce873f191b67ea015ab
-
SHA512
76c4a002291dbbb972c71e99bad7510ad3e3dbacb76dbddb540a14b2410c46059570176292cd75f5c23cc8c6c5d100d49e59d624b0b64713df9c921687278c94
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-