General
-
Target
dd24ab5fe574c6c35990e8f63672d9b146fdbed1dbc6e9a2150e565413fada1c.exe
-
Size
573KB
-
Sample
220514-q5j1zahhh5
-
MD5
e209164c829d0fb45a0d0be724217e0f
-
SHA1
8e8c95a31b37727bbfed597a7dcebd6a77e29529
-
SHA256
dd24ab5fe574c6c35990e8f63672d9b146fdbed1dbc6e9a2150e565413fada1c
-
SHA512
3db4e9038bb3d7140491944ec29289997b75730bf4a07e448afb02ff08806fe4b1b27795edb4075f46c9489c064a0b6f76602309388566b172426019efeaca4c
Static task
static1
Behavioral task
behavioral1
Sample
dd24ab5fe574c6c35990e8f63672d9b146fdbed1dbc6e9a2150e565413fada1c.exe
Resource
win7-20220414-en
Malware Config
Extracted
lokibot
http://sempersim.su/fo/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
dd24ab5fe574c6c35990e8f63672d9b146fdbed1dbc6e9a2150e565413fada1c.exe
-
Size
573KB
-
MD5
e209164c829d0fb45a0d0be724217e0f
-
SHA1
8e8c95a31b37727bbfed597a7dcebd6a77e29529
-
SHA256
dd24ab5fe574c6c35990e8f63672d9b146fdbed1dbc6e9a2150e565413fada1c
-
SHA512
3db4e9038bb3d7140491944ec29289997b75730bf4a07e448afb02ff08806fe4b1b27795edb4075f46c9489c064a0b6f76602309388566b172426019efeaca4c
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-