Static task
static1
Behavioral task
behavioral1
Sample
d81b40d87d7caee2e52fa109131ce7702810c9fb0f98f8a15fdd72f14146e513.exe
Resource
win7-20220414-en
General
-
Target
d81b40d87d7caee2e52fa109131ce7702810c9fb0f98f8a15fdd72f14146e513
-
Size
740KB
-
MD5
a305fe5a1a2d98b54d9acfb97f2d2525
-
SHA1
a9a03774732c584faef112beec2605d333b4181c
-
SHA256
d81b40d87d7caee2e52fa109131ce7702810c9fb0f98f8a15fdd72f14146e513
-
SHA512
8aeb61df7da99da3854c534c07c348f0d89cd1174722f8ad3a72d6606bb9cfb420afa3465f42a5a8fdad20b1a226ee157717c047607321d887bd2406f3ccb71d
-
SSDEEP
12288:7l74EufJUiNnZ6sLpULBcIuiGy+CAC0xOk5O052Vft35tKBZPXKTc:B7juRbNnZ6O0mIqC0xOn0kp7cnXKTc
Malware Config
Extracted
lokibot
http://citiline.org.ng/XXD123-TY/TULIP8890890-56788/Panel/five/fre,php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
Files
-
d81b40d87d7caee2e52fa109131ce7702810c9fb0f98f8a15fdd72f14146e513.exe windows x86
2977270fae1bfe1cc3a3258b5bc0e2ed
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
MethCallEngine
ord513
ord554
ord664
ord591
ord592
ord594
ord595
ord520
ord521
ord709
ord633
EVENT_SINK_AddRef
ord671
ord568
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord710
ord530
ord531
ord570
ord680
ord100
ord616
ord543
ord544
ord581
Sections
.text Size: 720KB - Virtual size: 719KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ