General
-
Target
Shipping Document.jpg.exe
-
Size
535KB
-
Sample
211201-rhvpmafgf9
-
MD5
0bedced4f80f29a3a4eacf08a57a7d1a
-
SHA1
f3aa3d1a2cd8478e9900f8e40568a073ecccf50b
-
SHA256
2327df8853c7f67ab43cda8c3f0494f148f74682aecaa685fd932bcc2b4df5a1
-
SHA512
2058cd590d6f843bcc101ab3a12368fbf3b35e8bc40e0e8c05932aa1b0627f2cac8a2e8e07dad3b095089351b9b7843e9a8d9d62f503997a7d746ce9a998e716
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Document.jpg.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Shipping Document.jpg.exe
Resource
win10-en-20211104
Malware Config
Extracted
lokibot
http://roboticsengineeringtech.xyz/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Shipping Document.jpg.exe
-
Size
535KB
-
MD5
0bedced4f80f29a3a4eacf08a57a7d1a
-
SHA1
f3aa3d1a2cd8478e9900f8e40568a073ecccf50b
-
SHA256
2327df8853c7f67ab43cda8c3f0494f148f74682aecaa685fd932bcc2b4df5a1
-
SHA512
2058cd590d6f843bcc101ab3a12368fbf3b35e8bc40e0e8c05932aa1b0627f2cac8a2e8e07dad3b095089351b9b7843e9a8d9d62f503997a7d746ce9a998e716
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-