General
-
Target
4d8836e7d058318c9850080d90c650f9
-
Size
444KB
-
Sample
220704-lcfqmaabe3
-
MD5
4d8836e7d058318c9850080d90c650f9
-
SHA1
e6d0e4f67a143b0c97aab0c60ce4f8dfe44e2773
-
SHA256
ebf17062065528a741f635ddbfa773618c23060a96609ce130bddffce137693a
-
SHA512
d888f5d181e891341a9203283d14745cb85ce615e5f4e1ade9e3571536c592b9f44447c1309f954aafc7e9f8dcec8dfdbe05808babaeb82f5c42885ff2847828
Static task
static1
Behavioral task
behavioral1
Sample
4d8836e7d058318c9850080d90c650f9.exe
Resource
win7-20220414-en
Malware Config
Extracted
lokibot
http://185.102.170.20/demo/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
4d8836e7d058318c9850080d90c650f9
-
Size
444KB
-
MD5
4d8836e7d058318c9850080d90c650f9
-
SHA1
e6d0e4f67a143b0c97aab0c60ce4f8dfe44e2773
-
SHA256
ebf17062065528a741f635ddbfa773618c23060a96609ce130bddffce137693a
-
SHA512
d888f5d181e891341a9203283d14745cb85ce615e5f4e1ade9e3571536c592b9f44447c1309f954aafc7e9f8dcec8dfdbe05808babaeb82f5c42885ff2847828
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-