General
-
Target
nueva cotización.PDF.bat
-
Size
754KB
-
Sample
210226-ardp9n7j8e
-
MD5
facb14f65870c990c32679776b7d0ce2
-
SHA1
d711e17f5e66919ceec6ba5c77e45325c81b1f74
-
SHA256
dba85869242d60ad43228d1cbeef917f51096602f7db233e0972eb1091b4c355
-
SHA512
28e510a8f805874eda9d3abf1ce65f1663f96545f5c3588a6113802a69e51ae31c39eb65f7631ab4923d760c25adc2b7dcae84af764403f4bd3a2c918bf4a635
Static task
static1
Behavioral task
behavioral1
Sample
nueva cotización.PDF.bat.exe
Resource
win7v20201028
Malware Config
Extracted
lokibot
http://51.195.53.221/p.php/ZtkNeeK6C94X6
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
nueva cotización.PDF.bat
-
Size
754KB
-
MD5
facb14f65870c990c32679776b7d0ce2
-
SHA1
d711e17f5e66919ceec6ba5c77e45325c81b1f74
-
SHA256
dba85869242d60ad43228d1cbeef917f51096602f7db233e0972eb1091b4c355
-
SHA512
28e510a8f805874eda9d3abf1ce65f1663f96545f5c3588a6113802a69e51ae31c39eb65f7631ab4923d760c25adc2b7dcae84af764403f4bd3a2c918bf4a635
-
Suspicious use of SetThreadContext
-