General
-
Target
SHIPPING DOC.exe
-
Size
251KB
-
Sample
200710-al9h9gk286
-
MD5
09c2c6e212675f9a716af51853a74aba
-
SHA1
a443db12216d17d224f831080b4b4f76967c1e9c
-
SHA256
9742adf8c511be66c57c236b2849338090c3b7cc0f7ac13f5ff14cdcbfe19912
-
SHA512
a18a1e6ab993a4390f66afb8d531d22312c86b0a51d6bc22f9984f80b28a83fe062b227892fb8813197000480f91cac08a4080af6db36155bad6952dc33eb4a1
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOC.exe
Resource
win7
Behavioral task
behavioral2
Sample
SHIPPING DOC.exe
Resource
win10v200430
Malware Config
Extracted
lokibot
http://mecharnise.ir/ea7/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
SHIPPING DOC.exe
-
Size
251KB
-
MD5
09c2c6e212675f9a716af51853a74aba
-
SHA1
a443db12216d17d224f831080b4b4f76967c1e9c
-
SHA256
9742adf8c511be66c57c236b2849338090c3b7cc0f7ac13f5ff14cdcbfe19912
-
SHA512
a18a1e6ab993a4390f66afb8d531d22312c86b0a51d6bc22f9984f80b28a83fe062b227892fb8813197000480f91cac08a4080af6db36155bad6952dc33eb4a1
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-