SecuriteInfo[.]com[.]Trojan[.]Win32[.]Lokibot[.]DECC[.]MTB[.]13449[.]13417[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Trojan.Win32.Lokibot.DECC.MTB.13449.13417.exe
Size 182KB
Sample230828-nv55caaf76
SHA256 6aefd54fa38a79c06e9e652ed657de89171ff12c5db2a1b896e0813d3f53bb6a
MD5 84b755b79809c2ffe2f67eafea2d1a72
SHA1 558d789f1e7085bc1ad054d798042dba56a933c5
SHA512 9024315cba171bf82107544d6b0df2bfaaac8bddeb31739e8e0f1ee166874f669266db02366e71ddddd689fefcaa5cf10d0001f2ae95333e509347b97335c9da
SSDEEP 3072:J3q5H5Ya6vBw57NAJ6p+8uUKgNcCI73OvFJiPAg0FujDvPL49U:6HmlvO766U8tN4AO74e
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Trojan.Win32.Lokibot.DECC.MTB.13449.13417.exe

File Explorer

SecuriteInfo.com.Trojan.Win32.Lokibot.DECC.MTB.13449.13417.exe

.exe 182KB

SecuriteInfo.com.Trojan.Win32.Lokibot.DECC.MTB.13449.13417.exe

IMPHASH 0954beaebb211de35605a05432b8cbdc
SHA256 6aefd54fa38a79c06e9e652ed657de89171ff12c5db2a1b896e0813d3f53bb6a
MD5 84b755b79809c2ffe2f67eafea2d1a72
SHA1 558d789f1e7085bc1ad054d798042dba56a933c5
SHA512 9024315cba171bf82107544d6b0df2bfaaac8bddeb31739e8e0f1ee166874f669266db02366e71ddddd689fefcaa5cf10d0001f2ae95333e509347b97335c9da
SSDEEP 3072:J3q5H5Ya6vBw57NAJ6p+8uUKgNcCI73OvFJiPAg0FujDvPL49U:6HmlvO766U8tN4AO74e
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28615

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap HeapSize IsValidCodePage EnumSystemCodePagesW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType HeapAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapFree GetModuleHandleExW ExitProcess GetModuleFileNameW VirtualAlloc CloseHandle ReadFile GetFileSize FindNextFileW CreateFileW WriteFile GetStdHandle LoadLibraryExW FreeLibrary RtlUnwind RaiseException TerminateProcess GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW GetLastError WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection MultiByteToWideChar EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter WriteConsoleW

user32

DdeGetLastError SetClipboardViewer InvalidateRect SetWindowRgn IsCharLowerA MessageBeep CharUpperA GetScrollRange

gdi32

OffsetWindowOrgEx GdiGetBatchLimit EnumICMProfilesA CreateDCA PlayEnhMetaFile GetTextAlign GetFontResourceInfoW GetOutlineTextMetricsW EndFormPage AddFontResourceExA EnumFontFamiliesA

mapi32

ord182 ord30 ord67 ord186 ord177 ord180 ord24 ord52 ord53

odbc32

ord45 ord160 ord10 ord265 ord72 ord236

rtutils

RouterLogEventDataW TracePrintfA TraceDeregisterExW

mswsock

s_perror GetAddressByNameA rexec GetTypeByNameW

crypt32

CertNameToStrA CertEnumCRLContextProperties CertStrToNameW CertFreeCTLContext CertEnumCTLContextProperties

msacm32

acmFilterChooseA acmMetrics acmFormatTagEnumW acmFilterTagDetailsW acmFormatTagEnumA acmFormatTagDetailsA acmDriverRemove acmFormatChooseA acmDriverEnum acmDriverMessage acmFormatDetailsW