Panels

rtf:
https://www.hybrid-analysis.com/sample/6d5d461af97cc7d108f2df6e6cc8bf0198dbd1a0d87952af9d45127f12b2d5c7?environmentId=110

rar->exe
https://www.hybrid-analysis.com/sample/10ea8d9ccccce59ae420fe5b0ac0488fa136f6fbd3faa6747a198c25577f968f?environmentId=110

open dir:
http://31.3.230.31/bin/

http://justloki.com/Angel/five/
http://puttypot.info/Earl/five
http://houmehr.ir/cil/ddsssfsa/dwfwwe/dawas/eadewfe/Panel/
http://salesxpert.biz/Nwa/five/

a97eb8280fad85b7f5a53ef874a077327cdee1b952b768a6c6d8095c2ec1c4f0  binary.exe -> 73656e74696e656c.ru/zugu.file <- lokibot
9b2da70199a4498fa73cbe380ebb93ffa41fb0962dff68473ea9ca2a58924305  cross.exe <- lokibot
f98656f1c115c85c4294c71cd4cd04c2dbf769e02109062a7dc047ab900568a9  ebuka.exe <- lokibot
572c1ae9aa084e60c4c235247cf1f7e49d24740fd4e2d2af68f7473b781d080f  inv.exe <- lokibot
2c8c4baef6b91081b935b808adbf978519550b548465f4199180202b4a141852  nwa.exe <- lokibot
10ea8d9ccccce59ae420fe5b0ac0488fa136f6fbd3faa6747a198c25577f968f  Shipping Document DHL.exe <- lokibot
57029702919671466234264b8cadcec03151c7fe106cf30f145040b08b6b3dcc  valley.exe <- lokibot
6095c89d2fc86b215a1fe2d1848862d03736c9e91d4f3aa7009fb0837c1263b5  zugu.file <- lazagne