General
-
Target
Nuevo orden.PDF.bat
-
Size
881KB
-
Sample
210114-jzr7betc9a
-
MD5
abb865db5097adc68c8c9915c39e6534
-
SHA1
3aec309c3c66ddcb76c2d6f9bd779b07c4022223
-
SHA256
644fe9320e421d92bf74b5ab972f3fcef4e07fc0ff9cc21cdc3d569b49201ad5
-
SHA512
0b90671f6f74b2068183fd99dcd8b53c709aa9452e2b4c271442d39d334ca65c970d965fcce748be6eba77c4037c5af6dcc2f841fbd846c53facfb5cc2c3e46d
Static task
static1
Behavioral task
behavioral1
Sample
Nuevo orden.PDF.bat.exe
Resource
win7v20201028
Malware Config
Extracted
lokibot
http://51.195.53.221/p.php/dklX59XNxRkB6
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Nuevo orden.PDF.bat
-
Size
881KB
-
MD5
abb865db5097adc68c8c9915c39e6534
-
SHA1
3aec309c3c66ddcb76c2d6f9bd779b07c4022223
-
SHA256
644fe9320e421d92bf74b5ab972f3fcef4e07fc0ff9cc21cdc3d569b49201ad5
-
SHA512
0b90671f6f74b2068183fd99dcd8b53c709aa9452e2b4c271442d39d334ca65c970d965fcce748be6eba77c4037c5af6dcc2f841fbd846c53facfb5cc2c3e46d
-
Suspicious use of SetThreadContext
-