General
-
Target
ce624fe3d11cd5dfe05d262a43ef53b9
-
Size
526KB
-
Sample
220707-h13nhshbd6
-
MD5
ce624fe3d11cd5dfe05d262a43ef53b9
-
SHA1
fb7e4789a48ea2613229c63c7426ed74c53a8b07
-
SHA256
02ec85e897519787b0939d830a0a91144c1e50857c1ea9c18d313cd95e68e939
-
SHA512
69146652ff5196f5ec7a243f0e9eff72a1f97d123b3633b297379dec727e9f7eea5ada7b0998b6dc17ea00e075ec724461ce6ec2fcf9a7dc0a06333a07a9a8ed
Static task
static1
Behavioral task
behavioral1
Sample
ce624fe3d11cd5dfe05d262a43ef53b9.exe
Resource
win7-20220414-en
Malware Config
Extracted
lokibot
http://62.197.136.176/health4/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://��������������З������Й���Й��я��
Targets
-
-
Target
ce624fe3d11cd5dfe05d262a43ef53b9
-
Size
526KB
-
MD5
ce624fe3d11cd5dfe05d262a43ef53b9
-
SHA1
fb7e4789a48ea2613229c63c7426ed74c53a8b07
-
SHA256
02ec85e897519787b0939d830a0a91144c1e50857c1ea9c18d313cd95e68e939
-
SHA512
69146652ff5196f5ec7a243f0e9eff72a1f97d123b3633b297379dec727e9f7eea5ada7b0998b6dc17ea00e075ec724461ce6ec2fcf9a7dc0a06333a07a9a8ed
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-