Overview

overview

10

Static

static

10

1059-75028...12.exe

windows7-x64

1

1059-75028...12.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    60fcc651f845bb948397efbc27532ea1_JaffaCakes118

  • Size

    94KB

  • MD5

    60fcc651f845bb948397efbc27532ea1

  • SHA1

    a5f4ddc164e30d44c07f24f120a0eba570863b77

  • SHA256

    aecb379bd1a5fd3be43048397e9143660cf038e5a3831564ff2d3258a7551903

  • SHA512

    9745ed56a3b0a7eb5046568e5dc56e74bc692f84e451ae1b939b2edb485ceed8fb0a9a6283859e3f6b4d1d6e7385de4007c3e2e4135203de3b89c70f1c39ee6d

  • SSDEEP

    1536:Dscfg3zK4OrALbXnDC4SiuYzNkN7QrdeOiGhAeVc6jprLZaXpTm4oVof0jR3kfBH:q3zKvALbXnDHZrJHVNaFZ3yhm

Score
10/10
lokibot

Malware Config

Extracted

Family

lokibot

C2

http://omann.ir/enes/offi/ce/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot family
    lokibot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 60fcc651f845bb948397efbc27532ea1_JaffaCakes118
    .gz
  • 1059-7502821dcf68d42012118b9b79f265a5ca5a1212
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections