General
-
Target
fb7858cc3360d06a5a3895a721249409755e3c49542f5358899997c367ce9cd1.exe
-
Size
366KB
-
Sample
211021-n9ln9aacc5
-
MD5
79ac05ea2698147bdbb018833327b363
-
SHA1
0112d6b7fd7992801e02de8d55b4fc978c63d481
-
SHA256
fb7858cc3360d06a5a3895a721249409755e3c49542f5358899997c367ce9cd1
-
SHA512
dbc81de0b11e1da8a2986a163584762e2aadf8c8f9e466f1617aae488aa6d7fb1447ab64ef4acf45fb9f5a7445b114d5bf97a6e6ea79c7356c83649fc183fde0
Static task
static1
Behavioral task
behavioral1
Sample
fb7858cc3360d06a5a3895a721249409755e3c49542f5358899997c367ce9cd1.exe
Resource
win7-en-20211014
Malware Config
Extracted
lokibot
https://ilyasautotech.com.au/totech/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
fb7858cc3360d06a5a3895a721249409755e3c49542f5358899997c367ce9cd1.exe
-
Size
366KB
-
MD5
79ac05ea2698147bdbb018833327b363
-
SHA1
0112d6b7fd7992801e02de8d55b4fc978c63d481
-
SHA256
fb7858cc3360d06a5a3895a721249409755e3c49542f5358899997c367ce9cd1
-
SHA512
dbc81de0b11e1da8a2986a163584762e2aadf8c8f9e466f1617aae488aa6d7fb1447ab64ef4acf45fb9f5a7445b114d5bf97a6e6ea79c7356c83649fc183fde0
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-