General
- Target looorlki.exe
- Size 679KB
- Sample230706-xvcmgadh43
- SHA256 419cca9bccd0fa8919d3e2edcd18df08fbb066b6a3b21302e471d31c04cc0d10
- MD5 02702bec6d76bf792b0ce39f6fab58e9
- SHA1 8fb0abef62d7d9ae8bc78b26a6f7070d4952e1ba
- SHA512 2661e6c1b6205280bf54ab55d8850fc7e9a5c7e7c1596fd5bf9e922c05c96bd90e30bc705a1de8e7b526f7b867f0d675ed931a52f0f9ed291d8fadd9ec7f5329
- SSDEEP 12288:Oh1Lk70TnvjczcV0qoiCajgHXpES26ox0XDk7N7KTsuiexQK5VF1kgH:Ck70TrczcV0qk4iXpeRYg7x3ugK5VXd
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
looorlki.exe
Resource
win7-20230703-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
looorlki.exe
Resource
win10v2004-20230703-en
3 signatures
150 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://185.246.220.60/sweetwhore/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target looorlki.exe
- Size 679KB
- SHA256 419cca9bccd0fa8919d3e2edcd18df08fbb066b6a3b21302e471d31c04cc0d10
- MD5 02702bec6d76bf792b0ce39f6fab58e9
- SHA1 8fb0abef62d7d9ae8bc78b26a6f7070d4952e1ba
- SHA512 2661e6c1b6205280bf54ab55d8850fc7e9a5c7e7c1596fd5bf9e922c05c96bd90e30bc705a1de8e7b526f7b867f0d675ed931a52f0f9ed291d8fadd9ec7f5329
- SSDEEP 12288:Oh1Lk70TnvjczcV0qoiCajgHXpES26ox0XDk7N7KTsuiexQK5VF1kgH:Ck70TrczcV0qk4iXpeRYg7x3ugK5VXd
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext