General
-
Target
62dfbde9c630c2de686534eccbc9ef292733b1781d867bdf9a0be9db3072eac3.exe
-
Size
655KB
-
Sample
220521-yhxmjsgbfm
-
MD5
f09c574d47617319ec0a826217a22a70
-
SHA1
0ea6b7db099644820d4d84f497595a7c3feb54a6
-
SHA256
62dfbde9c630c2de686534eccbc9ef292733b1781d867bdf9a0be9db3072eac3
-
SHA512
cffa58dd4b09de748526067b8b877d9878b3a0aa9a9ccc11038c16fee7a802e9e67ab929f3d61928afcadfd0dc459c20c1254f1ad4157a830db717500830b6e1
Static task
static1
Behavioral task
behavioral1
Sample
62dfbde9c630c2de686534eccbc9ef292733b1781d867bdf9a0be9db3072eac3.exe
Resource
win7-20220414-en
Malware Config
Extracted
lokibot
http://sempersim.su/gg6/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
62dfbde9c630c2de686534eccbc9ef292733b1781d867bdf9a0be9db3072eac3.exe
-
Size
655KB
-
MD5
f09c574d47617319ec0a826217a22a70
-
SHA1
0ea6b7db099644820d4d84f497595a7c3feb54a6
-
SHA256
62dfbde9c630c2de686534eccbc9ef292733b1781d867bdf9a0be9db3072eac3
-
SHA512
cffa58dd4b09de748526067b8b877d9878b3a0aa9a9ccc11038c16fee7a802e9e67ab929f3d61928afcadfd0dc459c20c1254f1ad4157a830db717500830b6e1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-