Behavioral task
behavioral1
Sample
400000.locyo.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
400000.locyo.exe
Resource
win10v2004-20220812-en
General
-
Target
400000.locyo.exe
-
Size
648KB
-
MD5
88b4d9974b403f47e0d4edd6c83f8e00
-
SHA1
effc3e7164b3107dbc564283c3e1bbfdb51cdf3f
-
SHA256
4380251b9523800d1e3c788b26cc31480d748d27f8ec1d33202702f45fb6e352
-
SHA512
e1640dcdbb005eac537447f63e12b25ce7c6099b04a0084176debfc52b994e6a7701b15cfe2e71549fccb123faaa316dacaf3a7dc498f8d6605923fb92dc0cc8
-
SSDEEP
1536:LXzvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqbIzmdM:LsSHIG6mQwGmfOQd8YhY0/EeUG
Malware Config
Extracted
lokibot
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
Files
-
400000.locyo.exe.exe windows x86
9bec5d6b8cb7f18c72e5df0cc2b0d4a1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessHeap
HeapFree
HeapAlloc
SetLastError
GetLastError
oleaut32
VariantInit
SysFreeString
SysAllocString
ws2_32
getaddrinfo
freeaddrinfo
closesocket
WSAStartup
socket
send
recv
connect
combase
CoCreateInstance
CoUninitialize
ole32
CoInitialize
vaultcli
VaultEnumerateItems
VaultFree
VaultGetItem
VaultGetItem
VaultOpenVault
VaultCloseVault
Sections
.text Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 536KB - Virtual size: 536KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.x Size: 8KB - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE