General
-
Target
6829c0d3f696c54c157555b4efe6bbbce851169358fcc6f084ff2fbe7847cac2
-
Size
787KB
-
Sample
220705-znvktaege2
-
MD5
181afb4267ef3a367a03490a1e07b689
-
SHA1
1ec62e6d66a0a36eb357066e8fd224229cc54971
-
SHA256
6829c0d3f696c54c157555b4efe6bbbce851169358fcc6f084ff2fbe7847cac2
-
SHA512
c98a49ec0c714a2e47824f5401aabcf22aecf622b071b5a8c71a950c418209a868b689b935df2ff99aded6213aaab27d496c9b17c3ca74f2fd18480f6a0de75c
Static task
static1
Malware Config
Extracted
lokibot
http://37.0.11.227/rostov1/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://�����������Ѝ������Й���Й��я��
Targets
-
-
Target
6829c0d3f696c54c157555b4efe6bbbce851169358fcc6f084ff2fbe7847cac2
-
Size
787KB
-
MD5
181afb4267ef3a367a03490a1e07b689
-
SHA1
1ec62e6d66a0a36eb357066e8fd224229cc54971
-
SHA256
6829c0d3f696c54c157555b4efe6bbbce851169358fcc6f084ff2fbe7847cac2
-
SHA512
c98a49ec0c714a2e47824f5401aabcf22aecf622b071b5a8c71a950c418209a868b689b935df2ff99aded6213aaab27d496c9b17c3ca74f2fd18480f6a0de75c
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-