General
- Target Orden de contizacion.pdf.exe
- Size 1.7MB
- Sample220803-a1r8saeear
- SHA256 f0ec6836e0ffd8a1d57da428180b84adbb8844a2afbc5b5ed80f24d8e756b209
- MD5 123cea2154aba3d9e758698a046228e4
- SHA1 751ab0a42dbab16d3cd81dfa20bc6f4e6cf3be50
- SHA512 fbbc0b6d50cf389ef7244620abb852f968dea88bbe7fd291e168ebdfb5ea2d26738c7dde4716336989e6a5cd84c24c5858e620ee28858579c5c0aa5655ec62fb
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
Orden de contizacion.pdf.exe
Resource
win7-20220715-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Orden de contizacion.pdf.exe
Resource
win10v2004-20220721-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://sempersim.su/gj13/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target Orden de contizacion.pdf.exe
- Size 1.7MB
- SHA256 f0ec6836e0ffd8a1d57da428180b84adbb8844a2afbc5b5ed80f24d8e756b209
- MD5 123cea2154aba3d9e758698a046228e4
- SHA1 751ab0a42dbab16d3cd81dfa20bc6f4e6cf3be50
- SHA512 fbbc0b6d50cf389ef7244620abb852f968dea88bbe7fd291e168ebdfb5ea2d26738c7dde4716336989e6a5cd84c24c5858e620ee28858579c5c0aa5655ec62fb
- MD5 SHA1 SHA512
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext