General
-
Target
Contract 07072022.xlsx
-
Size
172KB
-
Sample
220707-cs49gsbham
-
MD5
44cadfe4ad7f2dd9361333885e2a286c
-
SHA1
5187ac0d987154a2ba22cd6c91320c8b6190ebf0
-
SHA256
1b8ba12f854e815d1b2eec259e9d63b90f46bdf492c0cc40c075b7fb8f6ac2c7
-
SHA512
0de0d4b9b12d3851fe701dbdf0ddcd32130ded36ca221b0932f961a8d53087ab4ddf80c8f9a30daec8163d2e7fec41633276c3bcac27e7b52488625e004d0da4
Static task
static1
Behavioral task
behavioral1
Sample
Contract 07072022.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Contract 07072022.xlsx
Resource
win10v2004-20220414-en
Malware Config
Extracted
lokibot
http://sempersim.su/gh20/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Contract 07072022.xlsx
-
Size
172KB
-
MD5
44cadfe4ad7f2dd9361333885e2a286c
-
SHA1
5187ac0d987154a2ba22cd6c91320c8b6190ebf0
-
SHA256
1b8ba12f854e815d1b2eec259e9d63b90f46bdf492c0cc40c075b7fb8f6ac2c7
-
SHA512
0de0d4b9b12d3851fe701dbdf0ddcd32130ded36ca221b0932f961a8d53087ab4ddf80c8f9a30daec8163d2e7fec41633276c3bcac27e7b52488625e004d0da4
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Abuses OpenXML format to download file from external location
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-