General
-
Target
5509d78e6da0b5e4dfc6371eadb9f1ce3520b67c840ce7c4181aad38cca779b4
-
Size
1.1MB
-
Sample
220725-vrx3wsfgd2
-
MD5
a8e187400ccedf1d3134c238455bd792
-
SHA1
98698c332b92c55cca793e3c31094061dc80403f
-
SHA256
5509d78e6da0b5e4dfc6371eadb9f1ce3520b67c840ce7c4181aad38cca779b4
-
SHA512
00156cd39a615b3ff92a7d03b1e61ede061a9bb493e3a57b6e1a3bca06ac83db9fd033744f5eac0385b8740472159e64bd65c5d9f22aad6f60ce08fe27290ad9
Static task
static1
Behavioral task
behavioral1
Sample
5509d78e6da0b5e4dfc6371eadb9f1ce3520b67c840ce7c4181aad38cca779b4.exe
Resource
win7-20220718-en
Malware Config
Extracted
lokibot
http://saftygroup.com/app/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
5509d78e6da0b5e4dfc6371eadb9f1ce3520b67c840ce7c4181aad38cca779b4
-
Size
1.1MB
-
MD5
a8e187400ccedf1d3134c238455bd792
-
SHA1
98698c332b92c55cca793e3c31094061dc80403f
-
SHA256
5509d78e6da0b5e4dfc6371eadb9f1ce3520b67c840ce7c4181aad38cca779b4
-
SHA512
00156cd39a615b3ff92a7d03b1e61ede061a9bb493e3a57b6e1a3bca06ac83db9fd033744f5eac0385b8740472159e64bd65c5d9f22aad6f60ce08fe27290ad9
-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-