General
-
Target
overskri.com.exe
-
Size
197KB
-
Sample
220121-cj7m9achbl
-
MD5
6eaeb3b2575361e191ee34c0baacf7b7
-
SHA1
673bf4970b55bf5d4a89cc14b0a977ccebb53789
-
SHA256
a42c56999d2837f01e3d1e04b7ce70fb17b1357a3ffb08d1e29eb09f8f8b0c05
-
SHA512
153ae58e82e37e0e13475e82df39937c175d48824e9ccee1cbe868d2fd32fcfcb967323df8db6eb1ecbecbc78a59c9dff232607936c16169e915a8d38f92b7ce
Static task
static1
Behavioral task
behavioral1
Sample
overskri.com.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
overskri.com.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
lokibot
http://windowssecuritycheck.gdn/jx/l/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Extracted
pony
http://windowssecuritycheck.gdn/jx/p/gate.php
Targets
-
-
Target
overskri.com.exe
-
Size
197KB
-
MD5
6eaeb3b2575361e191ee34c0baacf7b7
-
SHA1
673bf4970b55bf5d4a89cc14b0a977ccebb53789
-
SHA256
a42c56999d2837f01e3d1e04b7ce70fb17b1357a3ffb08d1e29eb09f8f8b0c05
-
SHA512
153ae58e82e37e0e13475e82df39937c175d48824e9ccee1cbe868d2fd32fcfcb967323df8db6eb1ecbecbc78a59c9dff232607936c16169e915a8d38f92b7ce
-
suricata: ET MALWARE Generic .bin download from Dotted Quad
suricata: ET MALWARE Generic .bin download from Dotted Quad
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-