General
- Target Request For Quotation 02-02-2022·pdf.exe
- Size 234KB
- Sample220202-slrb2sadfq
- SHA256 4f2de2a0bd843f00c61c5b03e0351eaec675253aeb69bc2707ab60aa42aba20a
- MD5 16f912117c0710c4313e9c3ed6ca848b
- SHA1 59e392a5475705bfc9bf9b9ff64026dde2931243
- SHA512 a1c5369797967f5aee0219eaae0f45274661c09cd391af556e9262b96b4cacc385dfb09e71a35579c303c03acf4a0629bbf68500db23e58c635281ee318b6af4
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Request For Quotation 02-02-2022·pdf.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Request For Quotation 02-02-2022·pdf.exe
Resource
win10v2004-en-20220113
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://128.199.46.58/~hgyf/?search=8375b925efd5311f17bbc96bc81343cf
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target Request For Quotation 02-02-2022·pdf.exe
- Size 234KB
- SHA256 4f2de2a0bd843f00c61c5b03e0351eaec675253aeb69bc2707ab60aa42aba20a
- MD5 16f912117c0710c4313e9c3ed6ca848b
- SHA1 59e392a5475705bfc9bf9b9ff64026dde2931243
- SHA512 a1c5369797967f5aee0219eaae0f45274661c09cd391af556e9262b96b4cacc385dfb09e71a35579c303c03acf4a0629bbf68500db23e58c635281ee318b6af4
- MD5 SHA1 SHA512
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles