General
-
Target
6789018157.exe
-
Size
832KB
-
Sample
221006-clq4aagbb4
-
MD5
728fdbe7cf7587f807cb2a769a776ef9
-
SHA1
b10f88f9495b990aa7aa7a9f4856e89f3f7061b4
-
SHA256
1aebe5d59997e78b81ad714be8dfd697665381018041c62a40a55f0ce215ea35
-
SHA512
9dbf58336e6e885e4d19d42eed1b3b87fd61d3eb78907d35e7384eabe7ed4c5dd88a1ca811e92ad1b0d36c21977f57dd4c8371ff6585407fb1d1d37cf4c5d25a
-
SSDEEP
12288:xPKR/4veD8lpIoYQMVa1kUCwYZ7HmIYiDnbVRgn6LyM40M3i:lw4veQGou+AVjDBRgniyeM3
Static task
static1
Behavioral task
behavioral1
Sample
6789018157.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6789018157.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
lokibot
http://162.0.223.13/?oTWpxPBp8jPKmiIpZe60rg2knpeKuIXTCTi9JUyRdoCzHlZGz5G
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
6789018157.exe
-
Size
832KB
-
MD5
728fdbe7cf7587f807cb2a769a776ef9
-
SHA1
b10f88f9495b990aa7aa7a9f4856e89f3f7061b4
-
SHA256
1aebe5d59997e78b81ad714be8dfd697665381018041c62a40a55f0ce215ea35
-
SHA512
9dbf58336e6e885e4d19d42eed1b3b87fd61d3eb78907d35e7384eabe7ed4c5dd88a1ca811e92ad1b0d36c21977f57dd4c8371ff6585407fb1d1d37cf4c5d25a
-
SSDEEP
12288:xPKR/4veD8lpIoYQMVa1kUCwYZ7HmIYiDnbVRgn6LyM40M3i:lw4veQGou+AVjDBRgniyeM3
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-