File name:

2018-05-07-Lokibot-extracted-from-attached-RAR-archive.exe

Full analysis: https://app.any.run/tasks/de1eca97-b2ab-4458-8572-adf782ad67c3
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Analysis date: April 29, 2025, 07:27:15
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lokibot
stealer
trojan
xor-url
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

0B09F5E0AD21B4E80CF4BEBD33CB6412

SHA1:

69C8BB61EAC811E0C667B520C081096A19959930

SHA256:

4D6B690C476DBE7929D0E9C630DF8374186B1B9E357F50F04494DB556FB857D8

SSDEEP:

3072:Bvar5Xsqb7iPTfErCHGp50aToLTjOpXIEy2lFNdwjWRQ+:Baiqb7crErCE2MXIEyK7wSQ+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Lokibot is detected

      • vbc.exe (PID: 7940)
    • LOKIBOT has been detected (YARA)

      • vbc.exe (PID: 7940)
    • XORed URL has been found (YARA)

      • vbc.exe (PID: 7940)
    • Connects to the CnC server

      • vbc.exe (PID: 7940)
    • LOKIBOT has been detected (SURICATA)

      • vbc.exe (PID: 7940)
  • SUSPICIOUS

    • The process executes VB scripts

      • 2018-05-07-Lokibot-extracted-from-attached-RAR-archive.exe (PID: 7612)
    • Executable content was dropped or overwritten

      • vbc.exe (PID: 7940)
    • Process drops legitimate windows executable

      • vbc.exe (PID: 7940)
    • Contacting a server suspected of hosting an CnC

      • vbc.exe (PID: 7940)
  • INFO

    • Checks supported languages

      • 2018-05-07-Lokibot-extracted-from-attached-RAR-archive.exe (PID: 7612)
    • Reads the computer name

      • 2018-05-07-Lokibot-extracted-from-attached-RAR-archive.exe (PID: 7612)
    • Reads the machine GUID from the registry

      • 2018-05-07-Lokibot-extracted-from-attached-RAR-archive.exe (PID: 7612)
      • vbc.exe (PID: 7940)
    • Create files in a temporary directory

      • 2018-05-07-Lokibot-extracted-from-attached-RAR-archive.exe (PID: 7612)
    • Creates files or folders in the user directory

      • vbc.exe (PID: 7940)
    • The sample compiled with english language support

      • vbc.exe (PID: 7940)
    • Checks proxy server information

      • slui.exe (PID: 7248)
    • Reads the software policy settings

      • slui.exe (PID: 7248)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

LokiBot

(PID) Process(7940) vbc.exe
C2http://oja34user.com/emma/Panel/five/fre.php
Decoys (4)kbfvzoboss.bid/alien/fre.php
alphastand.trade/alien/fre.php
alphastand.win/alien/fre.php
alphastand.top/alien/fre.php

xor-url

(PID) Process(7940) vbc.exe
Decrypted-URLs (1)http://oja34user.com/emma/Panel/five/fre.php
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:05:07 06:47:09+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 16896
InitializedDataSize: 140800
UninitializedDataSize: -
EntryPoint: 0x611e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2018-05-07-lokibot-extracted-from-attached-rar-archive.exe no specs #LOKIBOT vbc.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7248C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7612"C:\Users\admin\AppData\Local\Temp\2018-05-07-Lokibot-extracted-from-attached-RAR-archive.exe" C:\Users\admin\AppData\Local\Temp\2018-05-07-Lokibot-extracted-from-attached-RAR-archive.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\2018-05-07-lokibot-extracted-from-attached-rar-archive.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7940"C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
2018-05-07-Lokibot-extracted-from-attached-RAR-archive.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Version:
8.0.50727.9149
Modules
Images
c:\windows\syswow64\dpapi.dll
c:\windows\syswow64\mswsock.dll
c:\windows\syswow64\dnsapi.dll
c:\windows\syswow64\iphlpapi.dll
c:\windows\syswow64\nsi.dll
c:\windows\syswow64\fwpuclnt.dll
c:\windows\syswow64\rasadhlp.dll
c:\windows\syswow64\ntmarta.dll
LokiBot
(PID) Process(7940) vbc.exe
C2http://oja34user.com/emma/Panel/five/fre.php
Decoys (4)kbfvzoboss.bid/alien/fre.php
alphastand.trade/alien/fre.php
alphastand.win/alien/fre.php
alphastand.top/alien/fre.php
xor-url
(PID) Process(7940) vbc.exe
Decrypted-URLs (1)http://oja34user.com/emma/Panel/five/fre.php
Total events
4 127
Read events
4 126
Write events
1
Delete events
0

Modification events

(PID) Process:(7940) vbc.exeKey:HKEY_CURRENT_USER\������А���ˊ���ќ��К���Я����Й���Й��я��
Operation:writeName:F3F363
Value:
%APPDATA%\F3F363\3C28B3.exe
Executable files
1
Suspicious files
8
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
76122018-05-07-Lokibot-extracted-from-attached-RAR-archive.exeC:\Users\admin\AppData\Local\Temp\opxsj3xc.0.cstext
MD5:E622ED498F4183B776207B9896DF8C9E
SHA256:09967F191BF6FD5A675E539E608643C884176602178AAF7D481DFD681456AD01
7940vbc.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.exeexecutable
MD5:D881DE17AA8F2E2C08CBB7B265F928F9
SHA256:B3A37093609F9A20AD60B85A9FA9DE2BA674CBA9B5BD687729440C70BA619CA0
7940vbc.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.lckbinary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:
7940vbc.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\0f5007522459c86e95ffcc62f32308f1_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:D898504A722BFF1524134C6AB6A5EAA5
SHA256:878F32F76B159494F5A39F9321616C6068CDB82E88DF89BCC739BBC1EA78E1F9
76122018-05-07-Lokibot-extracted-from-attached-RAR-archive.exeC:\Users\admin\AppData\Local\Temp\opxsj3xc.cmdlinetext
MD5:8D3B0A72B2594923808C916D3EB15773
SHA256:CD99247D86BBB068E60A19A66BD38B590E8DE98D4641DE0B6D1FCBB03E034EC8
7940vbc.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.hdbbinary
MD5:1013079A9BF8FFA458C230EA6AAF8A89
SHA256:1B1F3BCE8DF0FC7E33B518DAB09D09AF3680E39BCC3C760DADCC50C931007BE8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
109
DNS requests
21
Threats
26

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7940
vbc.exe
POST
404
49.13.77.253:80
http://oja34user.com/emma/Panel/five/fre.php
unknown
malicious
7940
vbc.exe
POST
404
49.13.77.253:80
http://oja34user.com/emma/Panel/five/fre.php
unknown
malicious
7940
vbc.exe
POST
404
49.13.77.253:80
http://oja34user.com/emma/Panel/five/fre.php
unknown
malicious
7940
vbc.exe
POST
404
49.13.77.253:80
http://oja34user.com/emma/Panel/five/fre.php
unknown
malicious
7940
vbc.exe
POST
404
49.13.77.253:80
http://oja34user.com/emma/Panel/five/fre.php
unknown
malicious
7940
vbc.exe
POST
404
49.13.77.253:80
http://oja34user.com/emma/Panel/five/fre.php
unknown
malicious
7940
vbc.exe
POST
404
49.13.77.253:80
http://oja34user.com/emma/Panel/five/fre.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.73
  • 20.190.159.2
  • 20.190.159.23
  • 40.126.31.67
  • 40.126.31.0
  • 40.126.31.128
  • 40.126.31.131
whitelisted
google.com
  • 216.58.212.142
whitelisted
oja34user.com
  • 49.13.77.253
malicious
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
  • 2603:1030:7::106
whitelisted
206.23.85.13.in-addr.arpa
unknown
6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa
unknown
nexusrules.officeapps.live.com
  • 52.111.243.29
whitelisted

Threats

PID
Process
Class
Message
7940
vbc.exe
A Network Trojan was detected
ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
7940
vbc.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
7940
vbc.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
7940
vbc.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
7940
vbc.exe
A Network Trojan was detected
ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
7940
vbc.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
7940
vbc.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
7940
vbc.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
7940
vbc.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
7940
vbc.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
No debug info