General
-
Target
779fab5e3826ba8165c00507f22d08a0a81dd321d36b3426190565d87c1ffe6b
-
Size
932KB
-
Sample
211207-pnhk5shbdn
-
MD5
d131738343d3d9a57d7d0c9aa1dc30cd
-
SHA1
f78ceafb6ca40ed1fc14aef37166a249a4291891
-
SHA256
779fab5e3826ba8165c00507f22d08a0a81dd321d36b3426190565d87c1ffe6b
-
SHA512
fb95e15d847b43fa5773e4d8dec9e750734844d63fa57355277d6f15708f4fbcdb816ad582d3d62eee21dd8bc020e64c3794cc304463bdd54bdfddb8e66f8bc6
Static task
static1
Malware Config
Extracted
lokibot
http://lkk2.xyz/ddcontact/w2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
779fab5e3826ba8165c00507f22d08a0a81dd321d36b3426190565d87c1ffe6b
-
Size
932KB
-
MD5
d131738343d3d9a57d7d0c9aa1dc30cd
-
SHA1
f78ceafb6ca40ed1fc14aef37166a249a4291891
-
SHA256
779fab5e3826ba8165c00507f22d08a0a81dd321d36b3426190565d87c1ffe6b
-
SHA512
fb95e15d847b43fa5773e4d8dec9e750734844d63fa57355277d6f15708f4fbcdb816ad582d3d62eee21dd8bc020e64c3794cc304463bdd54bdfddb8e66f8bc6
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-