General
-
Target
18789ef5ed7b260c3690efc855172a471f2a131f2e02b51a5d4b9e602028e792
-
Size
1.1MB
-
Sample
220608-vt64kshahj
-
MD5
bb016d2b8f1d5caaa031d27f78dd55c0
-
SHA1
1e12609c62d946fca6bc3ffff59df6131777b1b1
-
SHA256
18789ef5ed7b260c3690efc855172a471f2a131f2e02b51a5d4b9e602028e792
-
SHA512
7ae4a451c6edd2d558889b849d6305b985bbbdc2ec9df78d8b41a687a49ade165b97251ef0e81d40c16360c97a457aabbdabf1a77ffc35652edcbb7d89859895
Static task
static1
Behavioral task
behavioral1
Sample
18789ef5ed7b260c3690efc855172a471f2a131f2e02b51a5d4b9e602028e792.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
18789ef5ed7b260c3690efc855172a471f2a131f2e02b51a5d4b9e602028e792.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
lokibot
http://lidgeys.ru/buch-x2/fred.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
18789ef5ed7b260c3690efc855172a471f2a131f2e02b51a5d4b9e602028e792
-
Size
1.1MB
-
MD5
bb016d2b8f1d5caaa031d27f78dd55c0
-
SHA1
1e12609c62d946fca6bc3ffff59df6131777b1b1
-
SHA256
18789ef5ed7b260c3690efc855172a471f2a131f2e02b51a5d4b9e602028e792
-
SHA512
7ae4a451c6edd2d558889b849d6305b985bbbdc2ec9df78d8b41a687a49ade165b97251ef0e81d40c16360c97a457aabbdabf1a77ffc35652edcbb7d89859895
Score10/10-
Drops startup file
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-