General
-
Target
897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
-
Size
1.3MB
-
Sample
210119-j12h9sg1ke
-
MD5
66f1cf3848c36e8111dc5f5a5784c2ad
-
SHA1
ad817b424694418345401fd28073dcaf4a24b22d
-
SHA256
897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38
-
SHA512
03b8b77555909c114b380f5a4dab50e817c5edf4e23fc5eddc92c61c758ca98cdb6fadfe8f8eea3162f3831cba1cccf7a969e28bc106c775205e630fc4404e33
Static task
static1
Behavioral task
behavioral1
Sample
897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
Resource
win7v20201028
Malware Config
Extracted
lokibot
http://51.195.53.221/p.php/dUQz9bwGRLNK7
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38.exe
-
Size
1.3MB
-
MD5
66f1cf3848c36e8111dc5f5a5784c2ad
-
SHA1
ad817b424694418345401fd28073dcaf4a24b22d
-
SHA256
897b0c3202ce39cf2929bc681b8dfe7344101bb9856b796e49cfe494e5f8ce38
-
SHA512
03b8b77555909c114b380f5a4dab50e817c5edf4e23fc5eddc92c61c758ca98cdb6fadfe8f8eea3162f3831cba1cccf7a969e28bc106c775205e630fc4404e33
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-