General
-
Target
DHL Express Receipt.exe
-
Size
1023KB
-
Sample
221004-nfghfaafh7
-
MD5
61cf71fdffa43e513ee0b7fc22858d3d
-
SHA1
12fe31f4a16c7d30a3e7de8659a0571e8929b1eb
-
SHA256
9965fd6b29b9aecaae9ec00b30cd41de793f3ff2d5a5edfcf1c967f3bbcf94bb
-
SHA512
5ca9b3e71f9ee9757a7ee8fd0ce18e00eec90d90adda598f75f44d91bc0f2c1d31a5b573f53bbb95c45f4e84644686fcd60f594ee6fab359dccd8d64139c3c63
-
SSDEEP
12288:OfUr/H/dPB7aR3jcN5HpXhmSUKRqQPjqmEA+B6Ihk6QxSVjxrL67cK4HTN:1f/dPAUbkYq088NDIFrLm
Static task
static1
Behavioral task
behavioral1
Sample
DHL Express Receipt.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
DHL Express Receipt.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
lokibot
http://162.0.223.13/?0ZbRoqHjbXfrX54fnD4rBmzDYlyFq8Yr7ajvA0OLY4dV9iaxVfYwByaATIgkQeLXp4tZ5i
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
DHL Express Receipt.exe
-
Size
1023KB
-
MD5
61cf71fdffa43e513ee0b7fc22858d3d
-
SHA1
12fe31f4a16c7d30a3e7de8659a0571e8929b1eb
-
SHA256
9965fd6b29b9aecaae9ec00b30cd41de793f3ff2d5a5edfcf1c967f3bbcf94bb
-
SHA512
5ca9b3e71f9ee9757a7ee8fd0ce18e00eec90d90adda598f75f44d91bc0f2c1d31a5b573f53bbb95c45f4e84644686fcd60f594ee6fab359dccd8d64139c3c63
-
SSDEEP
12288:OfUr/H/dPB7aR3jcN5HpXhmSUKRqQPjqmEA+B6Ihk6QxSVjxrL67cK4HTN:1f/dPAUbkYq088NDIFrLm
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-