General
-
Target
e6d1fbcf9929c353518f99d8ed9c842edff49dd94c52798c849d9b65ff756d0f.exe
-
Size
719KB
-
Sample
220216-pcd4ksbfe5
-
MD5
4a8e35c7190f769742bb51ce111e34c8
-
SHA1
6d996f0fb3ee86a617ce7c47e489235336129453
-
SHA256
e6d1fbcf9929c353518f99d8ed9c842edff49dd94c52798c849d9b65ff756d0f
-
SHA512
a095d430916548a0ba6b67d093c751db41750ac40e183cf3b6eca8e665dbf57acf48698d43fb355bc1e9f29508fcc7c92c419429b126a75a3551caf0b8df8604
Static task
static1
Behavioral task
behavioral1
Sample
e6d1fbcf9929c353518f99d8ed9c842edff49dd94c52798c849d9b65ff756d0f.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e6d1fbcf9929c353518f99d8ed9c842edff49dd94c52798c849d9b65ff756d0f.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
lokibot
http://secure01-redirect.net/gd3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
e6d1fbcf9929c353518f99d8ed9c842edff49dd94c52798c849d9b65ff756d0f.exe
-
Size
719KB
-
MD5
4a8e35c7190f769742bb51ce111e34c8
-
SHA1
6d996f0fb3ee86a617ce7c47e489235336129453
-
SHA256
e6d1fbcf9929c353518f99d8ed9c842edff49dd94c52798c849d9b65ff756d0f
-
SHA512
a095d430916548a0ba6b67d093c751db41750ac40e183cf3b6eca8e665dbf57acf48698d43fb355bc1e9f29508fcc7c92c419429b126a75a3551caf0b8df8604
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-