General
-
Target
Payment advice.xlsx
-
Size
176KB
-
Sample
220707-gfqmsagca7
-
MD5
d42bcd137e45be86f24566ffcd24df31
-
SHA1
c4625697573eba4a1588fe3ff315e6a6640e0b73
-
SHA256
51189309107e264547fad802573db35a2386fd619cf798d707ec94f2d37a1239
-
SHA512
c82b1beab9cecb7f0b1026c9c601eb3e334011f2d5b5000dc684d37ce4081797722a6b722c07249a9f7d958bc569af92b5384958ac0d08d9b2284bd79d70753f
Static task
static1
Behavioral task
behavioral1
Sample
Payment advice.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Payment advice.xlsx
Resource
win10v2004-20220414-en
Malware Config
Extracted
lokibot
http://sempersim.su/gg18/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Payment advice.xlsx
-
Size
176KB
-
MD5
d42bcd137e45be86f24566ffcd24df31
-
SHA1
c4625697573eba4a1588fe3ff315e6a6640e0b73
-
SHA256
51189309107e264547fad802573db35a2386fd619cf798d707ec94f2d37a1239
-
SHA512
c82b1beab9cecb7f0b1026c9c601eb3e334011f2d5b5000dc684d37ce4081797722a6b722c07249a9f7d958bc569af92b5384958ac0d08d9b2284bd79d70753f
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-