General
-
Target
DHL Shipping DoC.exe
-
Size
832KB
-
Sample
221005-mg4tpaeccl
-
MD5
5ccb41737c378fe3ba23ff5f13bd4990
-
SHA1
8f872f3e83fe76e48b6a89c9aaa530ce0083bb08
-
SHA256
02037e25527ba98d02717dade3370ba4fe15f1cb78eb0675d5a70359750a7ef4
-
SHA512
d0023d82917b954f8288c772e53d67e63925a596212ff60d423e69fd1936808d2e7a13b6df20f85efc27d877b7d873fd9ec2d8f131cc09184adfd413938d63a3
-
SSDEEP
12288:2PgnR/4ve5U02o5a+QO1c+cfPU4+fmoEjw0HQqfaH:se4vegmazOKfPDw6lf
Static task
static1
Behavioral task
behavioral1
Sample
DHL Shipping DoC.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
DHL Shipping DoC.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
lokibot
http://162.0.223.13/?0ZbRoqHjbXfrX54fnD4rBmzDYlyFq8Yr7ajvA0OLY4dV9iaxVfYwByaATIgkQeLXp4tZ5i
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
DHL Shipping DoC.exe
-
Size
832KB
-
MD5
5ccb41737c378fe3ba23ff5f13bd4990
-
SHA1
8f872f3e83fe76e48b6a89c9aaa530ce0083bb08
-
SHA256
02037e25527ba98d02717dade3370ba4fe15f1cb78eb0675d5a70359750a7ef4
-
SHA512
d0023d82917b954f8288c772e53d67e63925a596212ff60d423e69fd1936808d2e7a13b6df20f85efc27d877b7d873fd9ec2d8f131cc09184adfd413938d63a3
-
SSDEEP
12288:2PgnR/4ve5U02o5a+QO1c+cfPU4+fmoEjw0HQqfaH:se4vegmazOKfPDw6lf
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-