General
-
Target
New Order.pdf.exe
-
Size
306KB
-
Sample
200707-48kp7ybqzs
-
MD5
33734974cdccb671d66899e0cca55d84
-
SHA1
e8cefa5364738a13c537b5b4efb0f6d00e207991
-
SHA256
f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f
-
SHA512
c392843a80a73693a166bef590a15b1a6c3cfc51f46e767a941ea74bedc177ca223c40196a661e4c7dd3fd85f8047c6ea3d07d2919f9798f0b1c04066410f069
Static task
static1
Behavioral task
behavioral1
Sample
New Order.pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
New Order.pdf.exe
Resource
win10v200430
Malware Config
Extracted
lokibot
http://195.69.140.147/.op/cr.php/xbqxHCR0T1UiD
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
New Order.pdf.exe
-
Size
306KB
-
MD5
33734974cdccb671d66899e0cca55d84
-
SHA1
e8cefa5364738a13c537b5b4efb0f6d00e207991
-
SHA256
f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f
-
SHA512
c392843a80a73693a166bef590a15b1a6c3cfc51f46e767a941ea74bedc177ca223c40196a661e4c7dd3fd85f8047c6ea3d07d2919f9798f0b1c04066410f069
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-