General
-
Target
SecuriteInfo.com.Trojan.MSIL.LokiBot.RPH.MTB.85.14767
-
Size
947KB
-
Sample
221019-eaj7pseee9
-
MD5
e07e296e11f01775eeb51b9917c2d04c
-
SHA1
c7ceb604c11311b9f33f796231967dbccfb64046
-
SHA256
1a7c17fe2bfef24320b153fe3440489d3797d624ec0bb78c3e383784debcecec
-
SHA512
4b81ffafb209dbe855e2306ea26c8ec81372d00eaa1fde7fb5b52f4da6c579018646babbe80feac741db80da619285802e191041e69ddd50f8dde25632963ca6
-
SSDEEP
12288:dN9TQfEunigaGhkvAlZTsZfcJaPkrWyy+Tvkou+USEZp5jnwCIcALqGILl2lNh:VsMeZTB9r2cM+USEZXF7UZ
Malware Config
Extracted
formbook
4.1
ndgi
vuicotvxrejp3il.xyz
w3fa6.net
sappuno02.com
konstruksirumah.xyz
usalifehealth.com
and1f.xyz
atenmentfstinfdow.beauty
primepipe.net
roundhouseny.com
alexandermcqueen.icu
transporteavalos.com
spankmetaverse.xyz
jhccowholesale.com
bielefeldgebaeudereinigung.com
saintraphaelschool.com
larifaa.online
dejabrew.info
izabelaeraphael.com
granniestoneet.com
greensourceseed.com
Targets
-
-
Target
SecuriteInfo.com.Trojan.MSIL.LokiBot.RPH.MTB.85.14767
-
Size
947KB
-
MD5
e07e296e11f01775eeb51b9917c2d04c
-
SHA1
c7ceb604c11311b9f33f796231967dbccfb64046
-
SHA256
1a7c17fe2bfef24320b153fe3440489d3797d624ec0bb78c3e383784debcecec
-
SHA512
4b81ffafb209dbe855e2306ea26c8ec81372d00eaa1fde7fb5b52f4da6c579018646babbe80feac741db80da619285802e191041e69ddd50f8dde25632963ca6
-
SSDEEP
12288:dN9TQfEunigaGhkvAlZTsZfcJaPkrWyy+Tvkou+USEZp5jnwCIcALqGILl2lNh:VsMeZTB9r2cM+USEZXF7UZ
Score10/10-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Suspicious use of SetThreadContext
-