General
-
Target
3ad00239a6139a1a12a33f4fd56f724ad1ed850b8c633da74c73ed563b57b744
-
Size
468KB
-
Sample
220703-xeb11aceaq
-
MD5
d9bfd955e30eae4a46ec0990a8bca8da
-
SHA1
d5793febed21af138046cd6ad6a333279ddca0f3
-
SHA256
3ad00239a6139a1a12a33f4fd56f724ad1ed850b8c633da74c73ed563b57b744
-
SHA512
6b80118a06473e4bab544e9e7eff4407f7e7b10bdc21eb02b6ddb1f4d040b433362526f4608527217d236b140eab9eb9a3826f57443cc07d8d6636d3c4e737a4
Static task
static1
Behavioral task
behavioral1
Sample
3ad00239a6139a1a12a33f4fd56f724ad1ed850b8c633da74c73ed563b57b744.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3ad00239a6139a1a12a33f4fd56f724ad1ed850b8c633da74c73ed563b57b744.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
lokibot
https://komputerowybank.pl/images/gini/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
3ad00239a6139a1a12a33f4fd56f724ad1ed850b8c633da74c73ed563b57b744
-
Size
468KB
-
MD5
d9bfd955e30eae4a46ec0990a8bca8da
-
SHA1
d5793febed21af138046cd6ad6a333279ddca0f3
-
SHA256
3ad00239a6139a1a12a33f4fd56f724ad1ed850b8c633da74c73ed563b57b744
-
SHA512
6b80118a06473e4bab544e9e7eff4407f7e7b10bdc21eb02b6ddb1f4d040b433362526f4608527217d236b140eab9eb9a3826f57443cc07d8d6636d3c4e737a4
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-