General
- Target DHL.exe
- Size 972KB
- Sample220927-s77adsdgf5
- SHA256 b92fe59aa2e73d897609e92b467829473a3f65ffd7ca2d6d6f59d7a633cc7bb3
- MD5 178eee3d6f3c9f59448bbfae3b20c4e5
- SHA1 8f68c2971835fc3e333bd084e8a453b23cbd9193
- SHA512 8c27de4c90f0ec3c173be192e3bf55c6e5b6ac3b1f7b381f965178b02c08fb392cb923818c466608ea19f736b92c328a0e3dc95f2b8a60ea7d8af8ad0718e5fe
- SSDEEP 24576:WqEo1voEpCPhYkee5irph1DZoNyeiKuYQOT:WqjzcYZ2Ir1DyseNQ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DHL.exe
Resource
win7-20220812-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
DHL.exe
Resource
win10v2004-20220812-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://sempersim.su/gk19/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target DHL.exe
- Size 972KB
- SHA256 b92fe59aa2e73d897609e92b467829473a3f65ffd7ca2d6d6f59d7a633cc7bb3
- MD5 178eee3d6f3c9f59448bbfae3b20c4e5
- SHA1 8f68c2971835fc3e333bd084e8a453b23cbd9193
- SHA512 8c27de4c90f0ec3c173be192e3bf55c6e5b6ac3b1f7b381f965178b02c08fb392cb923818c466608ea19f736b92c328a0e3dc95f2b8a60ea7d8af8ad0718e5fe
- SSDEEP 24576:WqEo1voEpCPhYkee5irph1DZoNyeiKuYQOT:WqjzcYZ2Ir1DyseNQ
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext