General
-
Target
c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe
-
Size
1.0MB
-
Sample
220514-q5kmhacchr
-
MD5
e6aac02b7e6d8b28796e2f674505d13e
-
SHA1
d19fbc0b8fd75183bb50241875aa9fdf094da520
-
SHA256
c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f
-
SHA512
8658a4cfd2b775e55d980da424191dd2719831a4969a0ac95b8741ded41ac7666806710ed570684db3a9479be87ba6312c293e1d525be1a037c9c70501c1bae8
Static task
static1
Behavioral task
behavioral1
Sample
c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe
Resource
win7-20220414-en
Malware Config
Extracted
lokibot
http://sempersim.su/gf20/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f.exe
-
Size
1.0MB
-
MD5
e6aac02b7e6d8b28796e2f674505d13e
-
SHA1
d19fbc0b8fd75183bb50241875aa9fdf094da520
-
SHA256
c737bfd872527544c14ec50c589d0ff5bc26f8d643bc4441d190efe872a5b05f
-
SHA512
8658a4cfd2b775e55d980da424191dd2719831a4969a0ac95b8741ded41ac7666806710ed570684db3a9479be87ba6312c293e1d525be1a037c9c70501c1bae8
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-