General
-
Target
ab90d06c32681d3106c1f786bb2f15b4952c07deefda898171889f5df11e46e3
-
Size
583KB
-
Sample
220707-hhkpzsghd7
-
MD5
48e5cfe00cb324310e3291b025a9358f
-
SHA1
024caa50762b54a9b0f7f8a54836b2d145211b72
-
SHA256
ab90d06c32681d3106c1f786bb2f15b4952c07deefda898171889f5df11e46e3
-
SHA512
d40774ad3381a4d2ad590633d13c0c98d14251ad1befb7cec3afd33571942f13f731e8a60081a4d2401ba34cc4574c91df355fd9e7bbb91f7e9caa4352a20da8
Static task
static1
Malware Config
Extracted
lokibot
http://sempersim.su/gh20/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
ab90d06c32681d3106c1f786bb2f15b4952c07deefda898171889f5df11e46e3
-
Size
583KB
-
MD5
48e5cfe00cb324310e3291b025a9358f
-
SHA1
024caa50762b54a9b0f7f8a54836b2d145211b72
-
SHA256
ab90d06c32681d3106c1f786bb2f15b4952c07deefda898171889f5df11e46e3
-
SHA512
d40774ad3381a4d2ad590633d13c0c98d14251ad1befb7cec3afd33571942f13f731e8a60081a4d2401ba34cc4574c91df355fd9e7bbb91f7e9caa4352a20da8
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-