General
-
Target
bd210dbb0f224357098d5555c8ea6287cab5296dba37a2b26464d9b4bf689efc
-
Size
523KB
-
Sample
220707-gpbvzsgde4
-
MD5
6ba0950969868e55c90208548d6f641c
-
SHA1
8135670e2970189c91e89f3b05c4067085fbfb7e
-
SHA256
bd210dbb0f224357098d5555c8ea6287cab5296dba37a2b26464d9b4bf689efc
-
SHA512
dd1499dfb8f4b723788ecdf84ac08d697d9b0aca90f4609af001ee06f63024caf01bbbfcae8faccbaa72eddfd77f743240a133a4b100ecb279cfefee60c5b0d1
Static task
static1
Malware Config
Extracted
lokibot
http://sempersim.su/gg18/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
bd210dbb0f224357098d5555c8ea6287cab5296dba37a2b26464d9b4bf689efc
-
Size
523KB
-
MD5
6ba0950969868e55c90208548d6f641c
-
SHA1
8135670e2970189c91e89f3b05c4067085fbfb7e
-
SHA256
bd210dbb0f224357098d5555c8ea6287cab5296dba37a2b26464d9b4bf689efc
-
SHA512
dd1499dfb8f4b723788ecdf84ac08d697d9b0aca90f4609af001ee06f63024caf01bbbfcae8faccbaa72eddfd77f743240a133a4b100ecb279cfefee60c5b0d1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-