General
-
Target
SecuriteInfo.com.Variant.Midie.106755.28386.14528
-
Size
188KB
-
Sample
220121-lcgb6aehe3
-
MD5
fcdf169b996d6665693fd09de8c85aa9
-
SHA1
d6182222c7946ee1896f6b68c2cd099338afda45
-
SHA256
43bef6cb68e3b49bbc9e40c3b1642d6e7b0c465bc04d3082662bb2e8a66bd9e0
-
SHA512
931cc4f11d67b5204fa11c6d6e4198a7494730fe5757c14e1905345659b9f17459841169583061b16030c5008aa6d2ceb42cf1a2bf8f3630e3345098d8b4af8a
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Midie.106755.28386.14528.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.Midie.106755.28386.14528.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
lokibot
http://178.128.244.245/search.php?key=0bd3457ea97c45faa91eb5bd8e95e7a4
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
SecuriteInfo.com.Variant.Midie.106755.28386.14528
-
Size
188KB
-
MD5
fcdf169b996d6665693fd09de8c85aa9
-
SHA1
d6182222c7946ee1896f6b68c2cd099338afda45
-
SHA256
43bef6cb68e3b49bbc9e40c3b1642d6e7b0c465bc04d3082662bb2e8a66bd9e0
-
SHA512
931cc4f11d67b5204fa11c6d6e4198a7494730fe5757c14e1905345659b9f17459841169583061b16030c5008aa6d2ceb42cf1a2bf8f3630e3345098d8b4af8a
-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Accesses Microsoft Outlook profiles
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-