General
-
Target
49391448bd9766ace6139ba43384b1b0d19622a39e12ebcd962184204e58f176.exe
-
Size
551KB
-
Sample
220514-q5kbqsaaa6
-
MD5
43f2b822052f35890faf4920d95ba3be
-
SHA1
c3f54a2c7b8c26d81bfa4a881b3969bdd9ce10dc
-
SHA256
49391448bd9766ace6139ba43384b1b0d19622a39e12ebcd962184204e58f176
-
SHA512
147763f13ef1fbbe282ee1c5b7c7120f8ddcdd2d0ae860d477fd715ec94b4718fc377b1bf1f29f9dc8b1692ab723f0aa60f8835e41b4e7a1a08485ed7e4f0b35
Static task
static1
Behavioral task
behavioral1
Sample
49391448bd9766ace6139ba43384b1b0d19622a39e12ebcd962184204e58f176.exe
Resource
win7-20220414-en
Malware Config
Extracted
lokibot
http://sempersim.su/gf20/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
49391448bd9766ace6139ba43384b1b0d19622a39e12ebcd962184204e58f176.exe
-
Size
551KB
-
MD5
43f2b822052f35890faf4920d95ba3be
-
SHA1
c3f54a2c7b8c26d81bfa4a881b3969bdd9ce10dc
-
SHA256
49391448bd9766ace6139ba43384b1b0d19622a39e12ebcd962184204e58f176
-
SHA512
147763f13ef1fbbe282ee1c5b7c7120f8ddcdd2d0ae860d477fd715ec94b4718fc377b1bf1f29f9dc8b1692ab723f0aa60f8835e41b4e7a1a08485ed7e4f0b35
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-