General
-
Target
PO-USD#04072018.exe
-
Size
209KB
-
Sample
200630-h7bydjy6rj
-
MD5
9d99b9aff2251ca3b2ab0658ab1ec0a6
-
SHA1
b2e8a3ced8d1a4ef15432892ed2998920d4b7cd0
-
SHA256
e59a9f5da7389d07f3649a20a9e10135b7ab42c2c9711e8990b32aa3aa79eac8
-
SHA512
0d7fbfd5d3c72cd5557afcfcf805a650dcd14af308360f2bb18220276d632647baadb3c7752fef8dea79ba6bed7a951a9dc3ec358f1bc25a2beed6c416f432d0
Static task
static1
Behavioral task
behavioral1
Sample
PO-USD#04072018.exe
Resource
win7v200430
Malware Config
Extracted
lokibot
http://egamcorps.ga/~zadmin/lmark/pvent/mode.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
PO-USD#04072018.exe
-
Size
209KB
-
MD5
9d99b9aff2251ca3b2ab0658ab1ec0a6
-
SHA1
b2e8a3ced8d1a4ef15432892ed2998920d4b7cd0
-
SHA256
e59a9f5da7389d07f3649a20a9e10135b7ab42c2c9711e8990b32aa3aa79eac8
-
SHA512
0d7fbfd5d3c72cd5557afcfcf805a650dcd14af308360f2bb18220276d632647baadb3c7752fef8dea79ba6bed7a951a9dc3ec358f1bc25a2beed6c416f432d0
-
Blacklisted process makes network request
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-