Overview

overview

10

Static

static

10

356233734f...bf.exe

windows7_x64

10

356233734f...bf.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    356233734f03d5b38d8e17a72458296b72837f0e79a16cc844074d52595a03bf

  • Size

    144KB

  • MD5

    50bc43ff94e9abad1c326fd581d9e133

  • SHA1

    601af3d0068a29e11c23a504d7c2affbcbb4c04e

  • SHA256

    356233734f03d5b38d8e17a72458296b72837f0e79a16cc844074d52595a03bf

  • SHA512

    282be2446c89ce1a4c6e3f7335336f818c2f535a1e36b98f2b9ebbcf5f545eb6de59b5ad846294fff51b6873a38cc3e45c596c3e666087f43ee9f8d5906fc3cf

  • SSDEEP

    1536:JxqjQ+P04wsmJClYCGDwRcMkVQd8YhY0/EqfIzmdYHzvQSZpGS4/31A6mQgL28:sr85CTGmfOQd8YhY0/EqUGVSHIG6mQw

Score
10/10
neshtalokibot

Malware Config

Extracted

Family

lokibot

C2

http://deeshawears.com/test/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Detect Neshta Payload 1 IoCs
  • Lokibot family
    lokibot
  • Neshta family
    neshta

Files

  • 356233734f03d5b38d8e17a72458296b72837f0e79a16cc844074d52595a03bf
    .exe windows x86


    Headers

    Sections