General
-
Target
859c4d32d610fa0a47a5afd95c6dc1e1eb550ea8b93d6e2dc56f2db52354e345.exe
-
Size
605KB
-
Sample
220521-jl3weaahe2
-
MD5
ccfb1788d4a0c8d790b8453c95b936a6
-
SHA1
38cba2ec996aec8cc6a8a407b4df2ed339d367c1
-
SHA256
859c4d32d610fa0a47a5afd95c6dc1e1eb550ea8b93d6e2dc56f2db52354e345
-
SHA512
b77dd94a7e45452b82d673476f72297acdff7871699a1ec1a4475cbcd3b5bb0017c0b2afe1b0314fd28307b272b5cecb1c48854edf3c4423bf7320dee31bc8ee
Static task
static1
Behavioral task
behavioral1
Sample
859c4d32d610fa0a47a5afd95c6dc1e1eb550ea8b93d6e2dc56f2db52354e345.exe
Resource
win7-20220414-en
Malware Config
Extracted
lokibot
http://85.202.169.172/kelly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
859c4d32d610fa0a47a5afd95c6dc1e1eb550ea8b93d6e2dc56f2db52354e345.exe
-
Size
605KB
-
MD5
ccfb1788d4a0c8d790b8453c95b936a6
-
SHA1
38cba2ec996aec8cc6a8a407b4df2ed339d367c1
-
SHA256
859c4d32d610fa0a47a5afd95c6dc1e1eb550ea8b93d6e2dc56f2db52354e345
-
SHA512
b77dd94a7e45452b82d673476f72297acdff7871699a1ec1a4475cbcd3b5bb0017c0b2afe1b0314fd28307b272b5cecb1c48854edf3c4423bf7320dee31bc8ee
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-