General
-
Target
be9d64a9c4e505399806b3527a004086d6ba1c3a5d6cafd6f8d1b99cdc99a71f
-
Size
150KB
-
Sample
220520-3wp7vacebn
-
MD5
6c9c628d764c08c19563caad5dcbff87
-
SHA1
5fd8cd2b2bb2ee12d7a1d57a01707ff3fc8f6cdd
-
SHA256
be9d64a9c4e505399806b3527a004086d6ba1c3a5d6cafd6f8d1b99cdc99a71f
-
SHA512
56d4e732d0b1fd8ab716b0716cb8e34d0583ca353769355e17b54ae2cae410df753238a80503db2cbfe6e676013adc801fe20918dcf4bbc3b903790e3af87d3b
Static task
static1
Behavioral task
behavioral1
Sample
CQ GGM 41pcs F2.doc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
CQ GGM 41pcs F2.doc.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
lokibot
http://flexpak-th.com/osama/aboki/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
CQ GGM 41pcs F2.doc.exe
-
Size
280KB
-
MD5
c90dcca549e008b786c0e3754c8ecc6e
-
SHA1
1a8944c37e16284acce6ab47f922cd8145817c58
-
SHA256
e29652502d36677f45a5331102267daea34b2be41bad5c1c12601275d45f3ae3
-
SHA512
ac31f2d330ac6755641865b904b539ffc9853889068701c122c352177646aac2bb5ffb3d9580914fb08bcc9c998feed9441fc623dbbcbbbf9f43d33105fb4880
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-