General
-
Target
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe
-
Size
465KB
-
Sample
211102-pcxwpahdhl
-
MD5
d0a58eae99dfb90ea4aa5dbf24d2fb93
-
SHA1
83951b727bb85db87b55a3c68d2c7812640a6619
-
SHA256
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967
-
SHA512
399c77be146cffa43bb42aedd1b7a090baedfc175b20e6d2e3cf856359c061c9ebdbae3083e6bb9706d16f11c908dc5c6de5e93083788b12916d06d536d401de
Static task
static1
Behavioral task
behavioral1
Sample
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe
Resource
win10-en-20210920
Malware Config
Extracted
lokibot
http://secure01-redirect.net/ga18/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967.exe
-
Size
465KB
-
MD5
d0a58eae99dfb90ea4aa5dbf24d2fb93
-
SHA1
83951b727bb85db87b55a3c68d2c7812640a6619
-
SHA256
5342d363c887bc5df6640a5d0a7ae4dc5c9344615df002af7dbbb8aa7e669967
-
SHA512
399c77be146cffa43bb42aedd1b7a090baedfc175b20e6d2e3cf856359c061c9ebdbae3083e6bb9706d16f11c908dc5c6de5e93083788b12916d06d536d401de
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-