General
-
Target
09ea5b984463b26a7add02ad67824c07941bbc239bc2f0e71e5c142a34c18807
-
Size
1.1MB
-
Sample
220530-vjammagfbn
-
MD5
a4b5120afe5aa5e99d6a0da75d18ed0d
-
SHA1
3ca673f0399e29fef8b5cc2741dce12cdbd720b3
-
SHA256
09ea5b984463b26a7add02ad67824c07941bbc239bc2f0e71e5c142a34c18807
-
SHA512
8b7bf88ead50576e090077b5976edcd0153c344bea9ffc7d2f736dd11331956ce4427a57c12f8dbf857d8cf849bcea9d3501100c139b53dbcf2f26f5c2e3af1f
Static task
static1
Behavioral task
behavioral1
Sample
09ea5b984463b26a7add02ad67824c07941bbc239bc2f0e71e5c142a34c18807.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
09ea5b984463b26a7add02ad67824c07941bbc239bc2f0e71e5c142a34c18807.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
lokibot
http://dunysaki.ru/buch-x5/fred.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
09ea5b984463b26a7add02ad67824c07941bbc239bc2f0e71e5c142a34c18807
-
Size
1.1MB
-
MD5
a4b5120afe5aa5e99d6a0da75d18ed0d
-
SHA1
3ca673f0399e29fef8b5cc2741dce12cdbd720b3
-
SHA256
09ea5b984463b26a7add02ad67824c07941bbc239bc2f0e71e5c142a34c18807
-
SHA512
8b7bf88ead50576e090077b5976edcd0153c344bea9ffc7d2f736dd11331956ce4427a57c12f8dbf857d8cf849bcea9d3501100c139b53dbcf2f26f5c2e3af1f
Score10/10-
Drops startup file
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-