General
-
Target
CI + PL + BL.xlsx
-
Size
229KB
-
Sample
211202-lasbmshad6
-
MD5
dfb0d0351c1ce4de1e807c997bdcf01c
-
SHA1
baa008ac429087c9e3d81890806725db41ee0cca
-
SHA256
2439aacb932aa0c33aa6f17f2e0e00f613666889dfd01467e28bb96ae64ab17c
-
SHA512
4ad7d8b490373f5b86a94d986ac663565b2240d8a609764de0050128e831029e1c653f3c101667a8885855d1687d825cd00954965ab9d043459dd89727491ab5
Static task
static1
Behavioral task
behavioral1
Sample
CI + PL + BL.xlsx
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
CI + PL + BL.xlsx
Resource
win10-en-20211014
Malware Config
Extracted
lokibot
http://secure01-redirect.net/gb7/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
CI + PL + BL.xlsx
-
Size
229KB
-
MD5
dfb0d0351c1ce4de1e807c997bdcf01c
-
SHA1
baa008ac429087c9e3d81890806725db41ee0cca
-
SHA256
2439aacb932aa0c33aa6f17f2e0e00f613666889dfd01467e28bb96ae64ab17c
-
SHA512
4ad7d8b490373f5b86a94d986ac663565b2240d8a609764de0050128e831029e1c653f3c101667a8885855d1687d825cd00954965ab9d043459dd89727491ab5
Score10/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-