General
-
Target
Inquiry No PTD_00-2890.gz
-
Size
306KB
-
Sample
211021-q8n44aadd7
-
MD5
047b8c192590c99c128cdd05007f12a6
-
SHA1
9782ca61276d6ab8652728526608c9082aa7d2d4
-
SHA256
8a79d97f59890145217ae4d9e7a7b7fc5359169c0732cf8b0ebebbae316ed24f
-
SHA512
252ddb9c674415c1168ce5c35a14930a81f60a1723c51df701124576d87ab30bcf45245a14f07e4ae117540bbe1d81b561725804ad815b1d8f6c37f5754947f3
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry No PTD_00-2890.exe
Resource
win7-en-20211014
Malware Config
Extracted
lokibot
https://ilyasautotech.com.au/totech/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Inquiry No PTD_00-2890.exe
-
Size
366KB
-
MD5
79ac05ea2698147bdbb018833327b363
-
SHA1
0112d6b7fd7992801e02de8d55b4fc978c63d481
-
SHA256
fb7858cc3360d06a5a3895a721249409755e3c49542f5358899997c367ce9cd1
-
SHA512
dbc81de0b11e1da8a2986a163584762e2aadf8c8f9e466f1617aae488aa6d7fb1447ab64ef4acf45fb9f5a7445b114d5bf97a6e6ea79c7356c83649fc183fde0
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-