General
-
Target
8f8b7c084307b2c551365b9e11eda89536b460126b22019141521854454ec953
-
Size
106KB
-
Sample
220521-pvsppagae6
-
MD5
bdb7de6bf307ab5a7cba3dee2dbb4f0f
-
SHA1
2f8c632a52cd51b7aaefab0b6dc444c2a88b64c3
-
SHA256
8f8b7c084307b2c551365b9e11eda89536b460126b22019141521854454ec953
-
SHA512
dd1f6579221ca6cc2f5a36006e705f2fc065dab521d02adc625bbceb5abd4eeebd907f3c0273653c758975c8e66ea3e8b8131bf131d6ea7084068b98b51320f3
Static task
static1
Behavioral task
behavioral1
Sample
Consignment Details_pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Consignment Details_pdf.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
lokibot
http://195.69.140.147/.op/cr.php/wLb9ev15DMQIm
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Consignment Details_pdf.exe
-
Size
273KB
-
MD5
ef293bca8f54b6e410197f21a473036b
-
SHA1
6590b35b5d9ab56010c328a1f90db1922cb0a002
-
SHA256
d1b807ffbeb2c12281c41e785d314744777a47c2582cdb9ce677dac07fefca04
-
SHA512
b3d678839485986d0578f98360add9ac27fcac60a9464560a44a7cb3260fe4ce41f625f57635ac43fc8de64fe2cc04c035be6048ba666dd638248a3e6bf6489c
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-