Behavioral task
behavioral1
Sample
d1d27153da7a29dd0d1a7a593d895cb3560f5e2851303aa78fa16122abe196b3.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
d1d27153da7a29dd0d1a7a593d895cb3560f5e2851303aa78fa16122abe196b3.dll
Resource
win10v2004-20221111-en
General
-
Target
d1d27153da7a29dd0d1a7a593d895cb3560f5e2851303aa78fa16122abe196b3
-
Size
384KB
-
MD5
64ec06e8adb8b91043ef651cce01e515
-
SHA1
398a3b4e1c359266068b40a6725a6f627abc9b80
-
SHA256
d1d27153da7a29dd0d1a7a593d895cb3560f5e2851303aa78fa16122abe196b3
-
SHA512
5f34638c8db21514a5060f7b96da523ac5d3363f69d76d642771503f9bffeb21c71043d02a8c5d21766ac2a609bfa80b7338c7b63502f2a313044b6f23f56bec
-
SSDEEP
6144:wjL4OG3MdSFQs9J0POxRL+cd6bUfFdXT8Umsd1fTsim:wjkJ8dSOnPOr+wPXTE
Malware Config
Extracted
lokibot
http://171.22.30.147/gk1/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
Files
-
d1d27153da7a29dd0d1a7a593d895cb3560f5e2851303aa78fa16122abe196b3.dll windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 383KB - Virtual size: 382KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ