General
-
Target
130eebf2b017668c9f3be268ebf894fe.exe
-
Size
104KB
-
Sample
220701-1m63wsbbaq
-
MD5
130eebf2b017668c9f3be268ebf894fe
-
SHA1
f5dffabac90a595a1fc494f5ceb2919c50faebfe
-
SHA256
80405e9843f9dfc747620957c12880425bdcf79a0f0bc7ec17b85576c9c0952a
-
SHA512
a943a1fe67a8cb1286230944f2e41103c4d894461b672eb75c0d23adc726a76162c11a1ddd1d57307f1aeb8f697af2677deb44f86a46b3bbe31964707515293f
Static task
static1
Behavioral task
behavioral1
Sample
130eebf2b017668c9f3be268ebf894fe.exe
Resource
win7-20220414-en
Malware Config
Extracted
lokibot
http://��������������������Й���Й��я��
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
130eebf2b017668c9f3be268ebf894fe.exe
-
Size
104KB
-
MD5
130eebf2b017668c9f3be268ebf894fe
-
SHA1
f5dffabac90a595a1fc494f5ceb2919c50faebfe
-
SHA256
80405e9843f9dfc747620957c12880425bdcf79a0f0bc7ec17b85576c9c0952a
-
SHA512
a943a1fe67a8cb1286230944f2e41103c4d894461b672eb75c0d23adc726a76162c11a1ddd1d57307f1aeb8f697af2677deb44f86a46b3bbe31964707515293f
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-