General
-
Target
FB-108N && FB-108NK 詢價 - 田勤.zip
-
Size
355KB
-
Sample
211201-pvg8ysfbb4
-
MD5
46aa40d7c9cf29e8686bcf605dfa9eea
-
SHA1
1b07e565bf4683ae2ba3331c415503e93cebf2e7
-
SHA256
3d65ae2313acdbb408772a15b3b07fb4a3376089ec816982f0d09b07a0b7521f
-
SHA512
7612ce53e0079f18e92dbb2bd0f510216e4ecc628ed08b2b40519b6587a1d82fc21a1b862749bac3452bd803ac153c92f5a225acec716e235a25270112628237
Static task
static1
Behavioral task
behavioral1
Sample
FB-108N & FB-108NK ?? - ??.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
FB-108N & FB-108NK ?? - ??.exe
Resource
win10-en-20211104
Malware Config
Extracted
lokibot
http://secure01-redirect.net/gb17/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
FB-108N & FB-108NK ?? - ??.exe
-
Size
462KB
-
MD5
23e8b10bc9708ce38d0da718d2c7b9e8
-
SHA1
346b23fd367f6e4e7a7b92a5685c1944ab8ecee3
-
SHA256
44e315042610a77992cc00bd5927e367cfce988df51c6787a8d1ee1503bd97b2
-
SHA512
1e05e246996532ddc501c6f94969501fdf7e988d51a6b2698388f0fa0861686dbdc36a70b220a3bfc97cff89e346e2d911bda6d21db06f2358d8176f91c04d07
Score10/10-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-