Overview

overview

10

Static

static

10

d1ed72922a...a9.exe

windows7-x64

10

d1ed72922a...a9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VirusShare_b5a3cb742c0cc8585a3fd090b4485652.zip

  • Size

    51KB

  • MD5

    9686060521e8cd9a5319e8e6330f05a4

  • SHA1

    5858aa05da6e9718f035da8a44671990f7668858

  • SHA256

    26ec8889be17f20897c654662e9143d0f987a2054f352b919d55d9769be14316

  • SHA512

    450e00aca9fb40b2f695ae6301f75d8ac35eb0cc8fe7a1f00f1841db7db6c2f202652ac0050bb3e10cb5be403f2e483e551466e0342fc88b5eae1732de07c84e

  • SSDEEP

    768:cNKVzZzQcP1XU0yvZku17oBrhQQtoe/YwCqIjSrwXK3ivqTvDWL0fR4EybB:LVlzb1XQb17oNBtj5CvGrwXOiv0KXbB

Score
10/10
lokibot

Malware Config

Extracted

Family

lokibot

C2

http://svit-zer.com/cjsettings/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot family
    lokibot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • VirusShare_b5a3cb742c0cc8585a3fd090b4485652.zip
    .zip

    Password: infected

  • d1ed72922a3e987090ae3465ce27aa582e0101b0211780a0a796684a8f798da9
    .exe windows:5 windows x86 arch:x86

    Password: infected

    0239fd611af3d0e9b0c46c5837c80e09


    Headers

    Imports

    Sections