General
-
Target
51e0248a0f8d17896b47c5b120b710e6
-
Size
14KB
-
Sample
220707-f8fslsfhg5
-
MD5
51e0248a0f8d17896b47c5b120b710e6
-
SHA1
13cb7f9b545ba5c1d7881748c5436760fca2cb3f
-
SHA256
e9be075f5c7f30affb1f0d559258d65d64c0d7bdc34b950c0bb6860e84e9bc9d
-
SHA512
ee2b90f4d728f0709a0f1ca459c32e6cf17be975b57cc1da6fee06f94d8f2d423591746744b4d2fa7298b4757e56f0d5082d30e85cf05712e97524f59bfcd318
Static task
static1
Behavioral task
behavioral1
Sample
Payment_advice_0057584857.rtf
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Payment_advice_0057584857.rtf
Resource
win10v2004-20220414-en
Malware Config
Extracted
lokibot
http://sempersim.su/gi14/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Payment_advice_0057584857.doc
-
Size
9KB
-
MD5
26dd8d6b4fb32689556f412e15827e12
-
SHA1
56404155d33dca77f740adbe61f623574350ad0a
-
SHA256
f7ec7c7bbcc4b35d4dd7aa651643f4cd69f73b7dd8501214e6e7f6479185ac2d
-
SHA512
af006ea6f0507d6fb6d269f7fee60be2e294e4868db6a23bdc533f61f81b332f4bdd667bacbfc5938a63c7bb72b55099370655d2a770689cb23452d35c1abcdf
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-