General
- Target 47bb84ee36b0cbc4da3ba73d2207a70d.exe
- Size 378KB
- Sample211008-nyfnvseae7
- SHA256 045a53fd5d0d3cc470490e06b172f5a267de171fcdade2adfb6b16e4ca5b2cd7
- MD5 47bb84ee36b0cbc4da3ba73d2207a70d
- SHA1 d273a3a6ab81e031abb60969f0b8322475ad849b
- SHA512 6fa6c7115b2346f03aa2a971b7f9a0a48c94a917d7fdc2aca1934b9d3e99e99e349260f171b9d0f6a69d2c2058336850e9c536a3cf8dfa139ed877edb3c5721d
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
47bb84ee36b0cbc4da3ba73d2207a70d.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
47bb84ee36b0cbc4da3ba73d2207a70d.exe
Resource
win10-en-20210920
0 signatures
0 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://136.243.159.53/~element/page.php?id=491
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target 47bb84ee36b0cbc4da3ba73d2207a70d.exe
- Size 378KB
- SHA256 045a53fd5d0d3cc470490e06b172f5a267de171fcdade2adfb6b16e4ca5b2cd7
- MD5 47bb84ee36b0cbc4da3ba73d2207a70d
- SHA1 d273a3a6ab81e031abb60969f0b8322475ad849b
- SHA512 6fa6c7115b2346f03aa2a971b7f9a0a48c94a917d7fdc2aca1934b9d3e99e99e349260f171b9d0f6a69d2c2058336850e9c536a3cf8dfa139ed877edb3c5721d
- MD5 SHA1 SHA512
Score10/10Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext