General
- Target INVOICE.exe
- Size 621KB
- Sample230815-qq8qsach2v
- SHA256 8a3f9afd3f759dd491957371e15ece7f13daf97d2813bdec16bb57f457d2448e
- MD5 7766410f41d8a2f7bce1f7fe8f054419
- SHA1 4e80eceb1ad2874f94f7a37c977d9db843c0d87e
- SHA512 68d56a5917fc0e85e0a837d4a94cced52011ca88cf3a6e64fde1baf3c64e69a76712391ca7923a4638f428794e142ee7c287b56a927a1a7c1e088c19d7068692
- SSDEEP 6144:ntT+iT+1yp1I2RgGQqcjri/VFFdMJ1Lq/HHwrySnaOwRCBCRr0d5md9BRT+:ntB1pNQ/j6bdM+fQrpQds5mjBR
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
INVOICE.exe
Resource
win7-20230712-en
5 signatures
150 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://2.59.254.19/noko/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target INVOICE.exe
- Size 621KB
- SHA256 8a3f9afd3f759dd491957371e15ece7f13daf97d2813bdec16bb57f457d2448e
- MD5 7766410f41d8a2f7bce1f7fe8f054419
- SHA1 4e80eceb1ad2874f94f7a37c977d9db843c0d87e
- SHA512 68d56a5917fc0e85e0a837d4a94cced52011ca88cf3a6e64fde1baf3c64e69a76712391ca7923a4638f428794e142ee7c287b56a927a1a7c1e088c19d7068692
- SSDEEP 6144:ntT+iT+1yp1I2RgGQqcjri/VFFdMJ1Lq/HHwrySnaOwRCBCRr0d5md9BRT+:ntB1pNQ/j6bdM+fQrpQds5mjBR
- MD5 SHA1 SHA512 SSDEEP
-
Suspicious use of SetThreadContext