General
-
Target
Payment Notification.xll
-
Size
554KB
-
Sample
220120-1ns8esbhf5
-
MD5
68172769631a891bc5790feb75823f43
-
SHA1
e05ed4dbc6c2eb776c95007f62711c682b10c0c4
-
SHA256
e8ec7dcf12edf07c6099157c32557f41ebd74ddee6b125d1e34dcc4259dc10a7
-
SHA512
95c0980d2c06842c77b600bce5d8919e93ae206ad031d3ba88ae8c5ed9cdab81274c8cea04ef990553e045dc4173b0650074fcba79ce718b422a1642638b25b4
Static task
static1
Behavioral task
behavioral1
Sample
Payment Notification.xll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Payment Notification.xll
Resource
win10v2004-en-20220112
Malware Config
Extracted
Extracted
lokibot
http://windowssecuritycheck.gdn/jx/l/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Extracted
pony
http://windowssecuritycheck.gdn/jx/p/gate.php
Targets
-
-
Target
Payment Notification.xll
-
Size
554KB
-
MD5
68172769631a891bc5790feb75823f43
-
SHA1
e05ed4dbc6c2eb776c95007f62711c682b10c0c4
-
SHA256
e8ec7dcf12edf07c6099157c32557f41ebd74ddee6b125d1e34dcc4259dc10a7
-
SHA512
95c0980d2c06842c77b600bce5d8919e93ae206ad031d3ba88ae8c5ed9cdab81274c8cea04ef990553e045dc4173b0650074fcba79ce718b422a1642638b25b4
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Sets service image path in registry
-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-