File name:

SecuriteInfo.com.Win32.MalwareX-gen.29279.12893

Full analysis: https://app.any.run/tasks/2d872b42-8e4d-4185-a4b8-562ab961e130
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Analysis date: April 08, 2025, 06:43:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
lokibot
trojan
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

00D9A8BDD9E0F92DEDDB0732DA1714FC

SHA1:

03D680CA3CDE202CDD8F18F938B8101EA0920913

SHA256:

804CA58E99FE47F33EB0EE7DB9B0E4794DBE30C165F219BD85884F0F84AC7846

SSDEEP:

24576:dUJbyzdTJ/blJ4xXWOL6inSRXf1Kb9euyIF6FDT7/tMH:dUJbyzdTJDlJ4xXWOL6inSRXf1Kb9euv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Steals credentials from Web Browsers

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • LOKIBOT mutex has been found

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • Actions looks like stealing of personal data

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • Scans artifacts that could help determine the target

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • Lokibot is detected

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • LOKIBOT has been detected (SURICATA)

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • Connects to the CnC server

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • LOKIBOT has been detected (YARA)

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
  • SUSPICIOUS

    • Application launched itself

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 2852)
    • Reads security settings of Internet Explorer

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • Executable content was dropped or overwritten

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • Contacting a server suspected of hosting an CnC

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • Connects to the server without a host name

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
  • INFO

    • Checks supported languages

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 2852)
      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • Reads the machine GUID from the registry

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 2852)
      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • Reads the computer name

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 2852)
      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • .NET Reactor protector has been detected

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 2852)
    • Reads Microsoft Office registry keys

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • Creates files or folders in the user directory

      • SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe (PID: 728)
    • Reads the software policy settings

      • slui.exe (PID: 6048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

LokiBot

(PID) Process(728) SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
C294.156.177.41/alpha/five/fre.php
Decoys (4)kbfvzoboss.bid/alien/fre.php
alphastand.trade/alien/fre.php
alphastand.win/alien/fre.php
alphastand.top/alien/fre.php
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:08 05:35:27+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 549888
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0x88366
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.7.7.2
ProductVersionNumber: 8.7.7.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: WinRAR archiver
CompanyName: WinRAR
FileDescription: WinRAR archiver
FileVersion: 8.7.7.2
InternalName: cFhb.exe
LegalCopyright: Copyright © Alexander Roshal 1993-2014
LegalTrademarks: WinRAR.exe
OriginalFileName: cFhb.exe
ProductName: WinRAR
ProductVersion: 8.7.7.2
AssemblyVersion: 2.5.5.7
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start securiteinfo.com.win32.malwarex-gen.29279.12893.exe no specs sppextcomobj.exe no specs slui.exe #LOKIBOT securiteinfo.com.win32.malwarex-gen.29279.12893.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
User:
admin
Company:
WinRAR
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
8.7.7.2
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.malwarex-gen.29279.12893.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
LokiBot
(PID) Process(728) SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
C294.156.177.41/alpha/five/fre.php
Decoys (4)kbfvzoboss.bid/alien/fre.php
alphastand.trade/alien/fre.php
alphastand.win/alien/fre.php
alphastand.top/alien/fre.php
2852"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exeexplorer.exe
User:
admin
Company:
WinRAR
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
8.7.7.2
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.malwarex-gen.29279.12893.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5408C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6048"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7152C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
1 508
Read events
1 504
Write events
4
Delete events
0

Modification events

(PID) Process:(728) SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(728) SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(728) SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(728) SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exeKey:HKEY_CURRENT_USER\�������������О����Й���Й��я��
Operation:writeName:F3F363
Value:
%APPDATA%\F3F363\3C28B3.exe
Executable files
1
Suspicious files
4
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
728SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.lckbinary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:
728SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.hdbbinary
MD5:1013079A9BF8FFA458C230EA6AAF8A89
SHA256:1B1F3BCE8DF0FC7E33B518DAB09D09AF3680E39BCC3C760DADCC50C931007BE8
728SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exeC:\Users\admin\AppData\Roaming\F3F363\3C28B3.exeexecutable
MD5:00D9A8BDD9E0F92DEDDB0732DA1714FC
SHA256:804CA58E99FE47F33EB0EE7DB9B0E4794DBE30C165F219BD85884F0F84AC7846
728SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\0f5007522459c86e95ffcc62f32308f1_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:D898504A722BFF1524134C6AB6A5EAA5
SHA256:878F32F76B159494F5A39F9321616C6068CDB82E88DF89BCC739BBC1EA78E1F9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
22
DNS requests
14
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
POST
404
94.156.177.41:80
http://94.156.177.41/alpha/five/fre.php
unknown
malicious
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
POST
404
94.156.177.41:80
http://94.156.177.41/alpha/five/fre.php
unknown
malicious
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
POST
404
94.156.177.41:80
http://94.156.177.41/alpha/five/fre.php
unknown
malicious
4452
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
4452
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
POST
404
94.156.177.41:80
http://94.156.177.41/alpha/five/fre.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
192.168.100.255:137
whitelisted
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
94.156.177.41:80
Vivacom
BG
malicious
4452
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.42
  • 23.216.77.28
whitelisted
google.com
  • 142.250.185.110
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.128
  • 40.126.31.67
  • 20.190.159.71
  • 20.190.159.4
  • 20.190.159.130
  • 20.190.159.131
  • 40.126.31.0
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
A Network Trojan was detected
ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 13
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Request for C2 Commands Detected M2
728
SecuriteInfo.com.Win32.MalwareX-gen.29279.12893.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Request for C2 Commands Detected M1
No debug info