General
-
Target
798fceb7a7e82c3d02867a7c163e6dd356f8b39c6fd20f7030eac68f4928907f.exe
-
Size
315KB
-
Sample
220521-yhxybadab3
-
MD5
88782ac0e364987d780341f55f15d7bd
-
SHA1
78064ef8444f7ddaf01051a73b86ac8c70f3ecdd
-
SHA256
798fceb7a7e82c3d02867a7c163e6dd356f8b39c6fd20f7030eac68f4928907f
-
SHA512
cf59a93c6b1e4b4a90da3eb414035e6fc9b20a1bbe6d1187e10bd227e31237efb931f6238be091efb9404f219b236ad7a6dbad99d31e73ad34d9b03f67e8a281
Static task
static1
Behavioral task
behavioral1
Sample
798fceb7a7e82c3d02867a7c163e6dd356f8b39c6fd20f7030eac68f4928907f.exe
Resource
win7-20220414-en
Malware Config
Extracted
lokibot
http://198.187.30.47/p.php?id=34111777851915435
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
798fceb7a7e82c3d02867a7c163e6dd356f8b39c6fd20f7030eac68f4928907f.exe
-
Size
315KB
-
MD5
88782ac0e364987d780341f55f15d7bd
-
SHA1
78064ef8444f7ddaf01051a73b86ac8c70f3ecdd
-
SHA256
798fceb7a7e82c3d02867a7c163e6dd356f8b39c6fd20f7030eac68f4928907f
-
SHA512
cf59a93c6b1e4b4a90da3eb414035e6fc9b20a1bbe6d1187e10bd227e31237efb931f6238be091efb9404f219b236ad7a6dbad99d31e73ad34d9b03f67e8a281
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-