General
-
Target
file.exe
-
Size
595KB
-
Sample
200630-nr7ycmc1c6
-
MD5
fab404e9df64df68df97d11f691e177d
-
SHA1
bbfad4c8c65e980830a954301337dc5bfb45cf9e
-
SHA256
719f49f86929312a50e32c1f2513aa9b8ca1308fc667daeb1208ddae177aba75
-
SHA512
22fb633655e906f1e7948ff93b2905c0cf74811bc90cf19c03c0ab57b57bd2649cb1193e317e982b0a453681dbb2a8d83c3d18c7923c5e115dbe4eb47b034026
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7v200430
Malware Config
Extracted
lokibot
https://airmanselectiontest.com/dest/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
file.exe
-
Size
595KB
-
MD5
fab404e9df64df68df97d11f691e177d
-
SHA1
bbfad4c8c65e980830a954301337dc5bfb45cf9e
-
SHA256
719f49f86929312a50e32c1f2513aa9b8ca1308fc667daeb1208ddae177aba75
-
SHA512
22fb633655e906f1e7948ff93b2905c0cf74811bc90cf19c03c0ab57b57bd2649cb1193e317e982b0a453681dbb2a8d83c3d18c7923c5e115dbe4eb47b034026
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-