Overview

overview

10

Static

static

10

4b0a55626c...6c.exe

windows7-x64

10

4b0a55626c...6c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b0a55626c81e32082db4b7ca052028aa07c8233aa41dca19b9794c3a5c2886c

  • Size

    104KB

  • MD5

    281f04621aa774c0fba0d5a7b2eb1519

  • SHA1

    ac7e3e684fd849b1229a7196cc911e6958db1824

  • SHA256

    4b0a55626c81e32082db4b7ca052028aa07c8233aa41dca19b9794c3a5c2886c

  • SHA512

    724a1073d703282b34095c442bc7a241cc1bc816938d7952a6e985132597a58cc1fc0e532704d4961179bc0f31a422ba924dd420154dda20f7b835efce30fcaf

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqsIzmd:nSHIG6mQwGmfOQd8YhY0/EBUG

Score
10/10
lokibot

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/ha3/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables containing common artifacts observed in infostealers 1 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
  • Lokibot family
    lokibot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4b0a55626c81e32082db4b7ca052028aa07c8233aa41dca19b9794c3a5c2886c
    .exe windows:5 windows x86 arch:x86

    0239fd611af3d0e9b0c46c5837c80e09


    Headers

    Imports

    Sections