File name:

054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952

Full analysis: https://app.any.run/tasks/8095c353-b166-4efa-ba3e-5e52036057b6
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Malware Trends Tracker     >>>
Analysis date: September 03, 2025, 16:31:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lokibot
stealer
confuser
trojan
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 5 sections
MD5:

24899E0590707E01CD9FBDFAB6DD922B

SHA1:

AE88A813C9DD1D766134789052F1E8E1ECAEB4BE

SHA256:

054527988476FBDFCCA3D4EEC4D530C5529E2360B3F84BEAB0578B1411CAD952

SSDEEP:

12288:tCAJH34+vuj353RXSa1F4KW+KQK9tq0d4BDplP:t5Jo+2jFRXSOCKW+N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LOKIBOT mutex has been found

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4888)

    • Steals credentials from Web Browsers

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4888)

    • Actions looks like stealing of personal data

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4888)

    • Scans artifacts that could help determine the target

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4888)

    • LOKIBOT has been detected (YARA)

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4888)

    • Lokibot is detected

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4888)

  • SUSPICIOUS

    • Application launched itself

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 1508)

    • Executes application which crashes

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 1520)
      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4820)
      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4232)

    • Reads security settings of Internet Explorer

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4888)

  • INFO

    • Reads the machine GUID from the registry

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4888)
      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 1508)

    • Reads the computer name

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 1508)
      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4888)

    • Checks supported languages

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 1508)
      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4888)

    • Reads Microsoft Office registry keys

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4888)

    • Creates files or folders in the user directory

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4888)

    • Confuser has been detected (YARA)

      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4888)
      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4820)
      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 4232)
      • 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe (PID: 1520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

LokiBot

(PID) Process(4888) 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
C2http://94.156.65.182/tomthf/cvghx/five/fre.php
Decoys (4)kbfvzoboss.bid/alien/fre.php
alphastand.trade/alien/fre.php
alphastand.win/alien/fre.php
alphastand.top/alien/fre.php
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (38.3)
.exe | Win32 Executable (generic) (26.2)
.exe | Win16/32 Executable Delphi generic (12)
.exe | Generic Win/DOS Executable (11.6)
.exe | DOS Executable Generic (11.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:16 19:13:42+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 47616
InitializedDataSize: 318976
UninitializedDataSize: -
EntryPoint: 0x5e00a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.6.8.8
ProductVersionNumber: 2.6.8.8
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: ASg yw Swt
CompanyName: ASg yw Swt
FileDescription: ASg yw Swt
FileVersion: 2.6.8.8
InternalName: server1.exe
LegalCopyright: Copyright © 2024 ASg yw Swt
LegalTrademarks: ASg yw Swt
OriginalFileName: server1.exe
ProductName: ASg yw Swt
ProductVersion: 2.6.8.8
AssemblyVersion: 3.8.8.8
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe no specs #LOKIBOT 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1508"C:\Users\admin\AppData\Local\Temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe" C:\Users\admin\AppData\Local\Temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe—explorer.exe
User:
admin
Company:
ASg yw Swt
Integrity Level:
MEDIUM
Description:
ASg yw Swt
Exit code:
0
Version:
2.6.8.8
Modules
Images
c:\users\admin\appdata\local\temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1520C:\Users\admin\AppData\Local\Temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exeC:\Users\admin\AppData\Local\Temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
User:
admin
Company:
ASg yw Swt
Integrity Level:
MEDIUM
Description:
ASg yw Swt
Version:
2.6.8.8
Modules
Images
c:\users\admin\appdata\local\temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
2964C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4820 -s 80C:\Windows\SysWOW64\WerFault.exe—054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3160C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4020C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4232 -s 88C:\Windows\SysWOW64\WerFault.exe—054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4232C:\Users\admin\AppData\Local\Temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exeC:\Users\admin\AppData\Local\Temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
User:
admin
Company:
ASg yw Swt
Integrity Level:
MEDIUM
Description:
ASg yw Swt
Version:
2.6.8.8
Modules
Images
c:\users\admin\appdata\local\temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
4820C:\Users\admin\AppData\Local\Temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exeC:\Users\admin\AppData\Local\Temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
User:
admin
Company:
ASg yw Swt
Integrity Level:
MEDIUM
Description:
ASg yw Swt
Version:
2.6.8.8
Modules
Images
c:\users\admin\appdata\local\temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
4888C:\Users\admin\AppData\Local\Temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exeC:\Users\admin\AppData\Local\Temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
User:
admin
Company:
ASg yw Swt
Integrity Level:
MEDIUM
Description:
ASg yw Swt
Version:
2.6.8.8
Modules
Images
c:\users\admin\appdata\local\temp\054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
LokiBot
(PID) Process(4888) 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
C2http://94.156.65.182/tomthf/cvghx/five/fre.php
Decoys (4)kbfvzoboss.bid/alien/fre.php
alphastand.trade/alien/fre.php
alphastand.win/alien/fre.php
alphastand.top/alien/fre.php
5456C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1520 -s 80C:\Windows\SysWOW64\WerFault.exe—054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
1 991
Read events
1 988
Write events
3
Delete events
0

Modification events

(PID) Process:(4888) 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4888) 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4888) 054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
3
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4888054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\0f5007522459c86e95ffcc62f32308f1_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:D898504A722BFF1524134C6AB6A5EAA5
SHA256:878F32F76B159494F5A39F9321616C6068CDB82E88DF89BCC739BBC1EA78E1F9
4888054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.lckbinary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
7116
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
1268
svchost.exe
GET
200
72.246.29.11:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
5768
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
407 b
whitelisted
5768
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6980
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4888
054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
94.156.65.182:80
—
Terasyst Ltd
BG
malicious
7116
svchost.exe
20.190.160.5:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7116
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.78
whitelisted
login.live.com
  • 20.190.160.5
  • 20.190.160.65
  • 40.126.32.140
  • 20.190.160.132
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.67
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 72.246.29.11
  • 23.35.229.160
whitelisted
slscr.update.microsoft.com
  • 20.165.94.63
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
self.events.data.microsoft.com
  • 20.189.173.27
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952