General
- Target Payment Advice.pdf.exe
- Size 337KB
- Sample201119-l6bb9c7vzn
- SHA256 6854cc7c26e459c0e7ea583efd796fa5ca247692e3ebe3438dad71deca1efac6
- MD5 ab9a9899a87cfd0ec0eee6a8d7e52899
- SHA1 2d13b0b178d21ba56a6e8291c5cd599c07abfa3c
- SHA512 84c7b1f7ad466dbd1c8d04f5b1eb91a4ef6fb9e36f3cc01fe4e37bd4559804fb992feb1f3d93a57b3dcdafcbe269ae9311b4ea8cafef9a339c1e6eef3c3cef9d
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice.pdf.exe
Resource
win7v20201028
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://firnabulking.com/class/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target Payment Advice.pdf.exe
- Size 337KB
- SHA256 6854cc7c26e459c0e7ea583efd796fa5ca247692e3ebe3438dad71deca1efac6
- MD5 ab9a9899a87cfd0ec0eee6a8d7e52899
- SHA1 2d13b0b178d21ba56a6e8291c5cd599c07abfa3c
- SHA512 84c7b1f7ad466dbd1c8d04f5b1eb91a4ef6fb9e36f3cc01fe4e37bd4559804fb992feb1f3d93a57b3dcdafcbe269ae9311b4ea8cafef9a339c1e6eef3c3cef9d
- MD5 SHA1 SHA512
Score10/10-
Modifies service
-
Suspicious use of SetThreadContext