General
-
Target
Opik_lk.exe
-
Size
601KB
-
Sample
210404-j9zap1br9j
-
MD5
389c7a57f85a5abbc5f7d4f38d8c1188
-
SHA1
0d8eda613fd1f2d52be2a56fbaf87d4d8bda65a8
-
SHA256
e1622c22652985746a1bcb494d8e73efb6d56273f704401b33624ef6062f9a54
-
SHA512
6656ff4797ef7482a70d3e54fc2e2ea07eda729334f273b62a152e5f61169d951e8476ab147ce75c483860f6939554dda5aa2ec914038e966cb746658980289c
Static task
static1
Behavioral task
behavioral1
Sample
Opik_lk.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Opik_lk.exe
Resource
win10v20201028
Malware Config
Extracted
formbook
http://www.electronicservicesonline.com/jsyp/
chernigiv-quest.com
s-sashenzhen.com
curedtherapy.com
esketamine.doctor
advantagehail.com
greensolartechinternet.com
omaybread.com
afrocanlinks.com
luisxe.info
qygmuakh.club
mutlulukdileriz.net
lifelineglobalministries.today
aaa1roofing.com
bestcoworker.com
exclusiveoffer.bet
answerwill.com
canelonni.com
getuvewedre.com
mrhotelsthailand.com
brabantinecityrow.com
sparklycraze.com
thelungans.com
vivibrand.com
healthfromtheoutsidein.com
thelibraryofspice.com
stroudrealty.com
benfit-help18.club
cbg-hemp.com
ussnowbirds.com
stonetoweradvisory.com
gulfsouthequipmentsales.com
kosmolottosports.com
tchool.net
bestcuttingtools.com
ebn1.com
nilohoney.com
mamatyarirenntaru.club
tennissteustache.com
gradarquitectos.com
wwwmysweetapple.com
openupfuture.com
hieron.art
zgqclbuj.com
registro-digital-1bn.xyz
ayurpreneur.com
newyorkfishingcompany.com
pnkhotels.com
uplender.net
peacebeyourjourney.com
progressher.com
homebrewsupermarket.com
alliancecorporateconsulting.com
baoxinsm.com
christinaliew.net
euygunfirmalar.com
novelty-fishing-products.com
oorheersing.com
lottojoongsim.net
drmebpc.xyz
ploycraftmc.com
lifeimproviser.com
nukestate.com
cazaferry.com
manojmusic.com
Targets
-
-
Target
Opik_lk.exe
-
Size
601KB
-
MD5
389c7a57f85a5abbc5f7d4f38d8c1188
-
SHA1
0d8eda613fd1f2d52be2a56fbaf87d4d8bda65a8
-
SHA256
e1622c22652985746a1bcb494d8e73efb6d56273f704401b33624ef6062f9a54
-
SHA512
6656ff4797ef7482a70d3e54fc2e2ea07eda729334f273b62a152e5f61169d951e8476ab147ce75c483860f6939554dda5aa2ec914038e966cb746658980289c
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook Payload
-
Adds policy Run key to start application
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-