General
-
Target
0b47a3df832568b06ef48ec7a8930bee0561840f2f8c218b661177880913cef6
-
Size
211KB
-
Sample
220521-pzd24abecj
-
MD5
4d64e85f97593184d5f855114685aa86
-
SHA1
dcfd189bfe97eb09c32880c80bfd9ebe501980a3
-
SHA256
0b47a3df832568b06ef48ec7a8930bee0561840f2f8c218b661177880913cef6
-
SHA512
663d35c146445f7ffb1ed384a5e9318a97ddcb1e4aa841fa70d437d149ca3fe24158435f65352cf0ea7ac131c76c9ae07e7d905a974cd49c8fe8715f6685f6ac
Static task
static1
Behavioral task
behavioral1
Sample
new order.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
new order.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
lokibot
http://shehig.com/kingoo/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
new order.exe
-
Size
304KB
-
MD5
7c3af2b1640815d44ef42a11ffb3eb28
-
SHA1
059a0423d8f45c9ec833791071b6ab84dfa21ba9
-
SHA256
087836474ec9c75d0ebf6c9d36c805d0bf70bf2cc63985fb68d87797b1e923fa
-
SHA512
6c97323f45c50ff07d160eb16f0a9d558b73960413d5bd1377092711910d7f76a1e0ad8b3153044e1671e6a250e7d73d83fe3124752810be734cead7bc592b26
Score10/10-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-