General
-
Target
87ff199a7b223eb9ea6d24df439a4d65c28350bcb99b0f2694c33dbedc0046cf.exe
-
Size
664KB
-
Sample
220521-yhwp9achh4
-
MD5
7b7562a6fee4b75e2422eb9b2faecd5c
-
SHA1
f50fc80dfa8c00ea6d3b576963d4062fda21c1d9
-
SHA256
87ff199a7b223eb9ea6d24df439a4d65c28350bcb99b0f2694c33dbedc0046cf
-
SHA512
5d2077ce58c0d592740711e283203bb97a7ea0f33d7b84861141d99cc924c6999f180e7a4c3e5cb34e32d6821308514585117384fe93e7dcd2871eb2d2a1cff5
Static task
static1
Behavioral task
behavioral1
Sample
87ff199a7b223eb9ea6d24df439a4d65c28350bcb99b0f2694c33dbedc0046cf.exe
Resource
win7-20220414-en
Malware Config
Extracted
lokibot
http://sempersim.su/gg12/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
87ff199a7b223eb9ea6d24df439a4d65c28350bcb99b0f2694c33dbedc0046cf.exe
-
Size
664KB
-
MD5
7b7562a6fee4b75e2422eb9b2faecd5c
-
SHA1
f50fc80dfa8c00ea6d3b576963d4062fda21c1d9
-
SHA256
87ff199a7b223eb9ea6d24df439a4d65c28350bcb99b0f2694c33dbedc0046cf
-
SHA512
5d2077ce58c0d592740711e283203bb97a7ea0f33d7b84861141d99cc924c6999f180e7a4c3e5cb34e32d6821308514585117384fe93e7dcd2871eb2d2a1cff5
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-