General
-
Target
6de9d0536002020ba8f9128d72bbc854.exe
-
Size
824KB
-
Sample
221005-m46a2aebc5
-
MD5
6de9d0536002020ba8f9128d72bbc854
-
SHA1
44b7e0f3447478bd9c5405d39203d784b302f4fc
-
SHA256
7099be5190a44f8aa711f4a28117b1f1ae8272d7f36d26f12124f663fc523926
-
SHA512
f4dada74ae1d16a790c4e5fc08454b4b1346c9f5ef7ce5b3d4ad4830adda549ccb2fdf67cb5f7f67559672715d39f7028d1712fc6d25ecd58c86554546b60762
-
SSDEEP
12288:ZPXm9D/fpoxzWpWCN4HQ71Yg3F2Ia4WYw+AKTaRiXST7a1DR/4ve:tMD/Rog5N4w71N3FvRw+BTxXAa114ve
Static task
static1
Behavioral task
behavioral1
Sample
6de9d0536002020ba8f9128d72bbc854.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6de9d0536002020ba8f9128d72bbc854.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
lokibot
http://208.67.105.161/donstan/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
6de9d0536002020ba8f9128d72bbc854.exe
-
Size
824KB
-
MD5
6de9d0536002020ba8f9128d72bbc854
-
SHA1
44b7e0f3447478bd9c5405d39203d784b302f4fc
-
SHA256
7099be5190a44f8aa711f4a28117b1f1ae8272d7f36d26f12124f663fc523926
-
SHA512
f4dada74ae1d16a790c4e5fc08454b4b1346c9f5ef7ce5b3d4ad4830adda549ccb2fdf67cb5f7f67559672715d39f7028d1712fc6d25ecd58c86554546b60762
-
SSDEEP
12288:ZPXm9D/fpoxzWpWCN4HQ71Yg3F2Ia4WYw+AKTaRiXST7a1DR/4ve:tMD/Rog5N4w71N3FvRw+BTxXAa114ve
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-