General
-
Target
cee3904c1eb0245328cbbe8770f69417d56218ba9ed6ded95d60183264557fef.exe
-
Size
564KB
-
Sample
241223-csx56svjgm
-
MD5
f4c0448c427e926b0d3c0d1fbc1a866e
-
SHA1
273aa64fd2523237acde7d342a09a259a3c5499a
-
SHA256
cee3904c1eb0245328cbbe8770f69417d56218ba9ed6ded95d60183264557fef
-
SHA512
605665259a268ccf31d01c6332693d259f37efa72e517dc6bc09c5fc66b53b274bfd9f111607499f9aad64c87aa70b8c9c21fe69a6c532b193e2704f1ce9fd1c
-
SSDEEP
12288:qVAsGfYtKR7zmF4WdwGexfoAu9kcNuuh5:qVAsGfYtKR7yFjdwGexf5u9kcNuuh5
Static task
static1
Behavioral task
behavioral1
Sample
cee3904c1eb0245328cbbe8770f69417d56218ba9ed6ded95d60183264557fef.exe
Resource
win7-20240903-en
Malware Config
Extracted
lokibot
https://publicspeaking.co.id/okoye/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
cee3904c1eb0245328cbbe8770f69417d56218ba9ed6ded95d60183264557fef.exe
-
Size
564KB
-
MD5
f4c0448c427e926b0d3c0d1fbc1a866e
-
SHA1
273aa64fd2523237acde7d342a09a259a3c5499a
-
SHA256
cee3904c1eb0245328cbbe8770f69417d56218ba9ed6ded95d60183264557fef
-
SHA512
605665259a268ccf31d01c6332693d259f37efa72e517dc6bc09c5fc66b53b274bfd9f111607499f9aad64c87aa70b8c9c21fe69a6c532b193e2704f1ce9fd1c
-
SSDEEP
12288:qVAsGfYtKR7zmF4WdwGexfoAu9kcNuuh5:qVAsGfYtKR7yFjdwGexf5u9kcNuuh5
-
Lokibot family
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-