lgoogloader

Target

a.bin
Size

5KB
Sample

230516-wr6wgabb2s
MD5

69525fa93fd47eb3c533afe3b1baba48
SHA1

3dea1b337987177c73c64e89b370d90dc94c64cb
SHA256

8e9c6b72a19705e65d654814d0770a67c7c4a2e52915f6115dc740ab254ed4a9
SHA512

909202467de5c96404c154cd3be55643df62c13c395bd6e0406be5834c3a10b953f42cc3520ac5979af754af192260ec737d19892333e5a8dfab79aef9b23182
SSDEEP

48:6di2oYDjX9iqhf3FXfkQHjJhyPFlWa8tYDdqIYM/cphuOulavTqXSfbNtm:uNiqp3JkQHyDUtE2WcpisvNzNt

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

PERSOM

176.124.219.192:14487

Attributes

auth_value
0695a610af712a57529526101d7e83b2

Extracted

Family

lokibot

http://185.246.220.85/zang1/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Extracted

Family

quasar

Version

1.4.0

Botnet

45.141.27.208:4780

127.0.0.1:4780

Mutex

d6e77ea9-bff7-4566-b4dd-f1be3c293c5e

Attributes

encryption_key
57F667877C1FCDA6663E2FDAC6FB8CFDE3CEA957
install_name
winx.exe
log_directory
Logs
reconnect_delay
3000
startup_key
winx
subdirectory
sys

Targets

- Target
  
  a.bin
- Size
  
  5KB
- MD5
  
  69525fa93fd47eb3c533afe3b1baba48
- SHA1
  
  3dea1b337987177c73c64e89b370d90dc94c64cb
- SHA256
  
  8e9c6b72a19705e65d654814d0770a67c7c4a2e52915f6115dc740ab254ed4a9
- SHA512
  
  909202467de5c96404c154cd3be55643df62c13c395bd6e0406be5834c3a10b953f42cc3520ac5979af754af192260ec737d19892333e5a8dfab79aef9b23182
- SSDEEP
  
  48:6di2oYDjX9iqhf3FXfkQHjJhyPFlWa8tYDdqIYM/cphuOulavTqXSfbNtm:uNiqp3JkQHyDUtE2WcpisvNzNt
Score

10^/10

lgoogloader lokibot pandastealer quasar redline persom x downloader evasion infostealer spyware stealer trojan upx vmprotect
- Detects LgoogLoader payload
- LgoogLoader
  A downloader capable of dropping and executing other malware families.
  downloader lgoogloader
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Panda Stealer payload
- PandaStealer
  Panda Stealer is a fork of CollectorProject Stealer written in C++.
  stealer pandastealer
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Downloads MZ/PE file
- Stops running service(s)
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Uses the VBS compiler for execution
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Legitimate hosting services abused for malware hosting/C2
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1