General
- Target win32.exe
- Size 237KB
- Sample220407-j5jxmsaebn
- SHA256 44eface2d74771701600e5d9e966e3a4f136fe0b38aa60fceee0992e97e9cd9e
- MD5 23b5f2f13dd12b0fcb055fd2d741bd14
- SHA1 359ddfd192dba18b1cfed22b7dccac8799023f92
- SHA512 7aced68ed237ab24967e243e74e13e431280b0fa1eafdb42b50b1b4bfc52bf78a09e9e8b4cc584131e0e33e0dbb898db04d132dbbe9338f8811bbc407d7a7572
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
win32.exe
Resource
win7-20220331-en
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://sempersim.su/gc23/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target win32.exe
- Size 237KB
- SHA256 44eface2d74771701600e5d9e966e3a4f136fe0b38aa60fceee0992e97e9cd9e
- MD5 23b5f2f13dd12b0fcb055fd2d741bd14
- SHA1 359ddfd192dba18b1cfed22b7dccac8799023f92
- SHA512 7aced68ed237ab24967e243e74e13e431280b0fa1eafdb42b50b1b4bfc52bf78a09e9e8b4cc584131e0e33e0dbb898db04d132dbbe9338f8811bbc407d7a7572
- MD5 SHA1 SHA512
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles