General
-
Target
tmp
-
Size
888KB
-
Sample
221006-d2ewmagca2
-
MD5
8ab4ebec842d01831f9166672e9a8774
-
SHA1
de53befe37b492fb0248de5bde6f562bb23caaa4
-
SHA256
c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189
-
SHA512
da35c669b1f590e6bb081286d615287357d6ab71544065b41cf8b739aaec4edada67ae4e3e8ad01ebf9e673780dae60c52980252356e2532a4f1f020e3c8bf78
-
SSDEEP
12288:AkUc2iN8R/4vev7MRICfAlzXXGasa3Vz/BencJR:A81Y4vev7MRklbbKcJR
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
lokibot
http://208.67.105.162/smart/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
tmp
-
Size
888KB
-
MD5
8ab4ebec842d01831f9166672e9a8774
-
SHA1
de53befe37b492fb0248de5bde6f562bb23caaa4
-
SHA256
c3235e1f345ac1b76d1b90683d8c3bfe340ba63f33cdb89267afa44ff2bf1189
-
SHA512
da35c669b1f590e6bb081286d615287357d6ab71544065b41cf8b739aaec4edada67ae4e3e8ad01ebf9e673780dae60c52980252356e2532a4f1f020e3c8bf78
-
SSDEEP
12288:AkUc2iN8R/4vev7MRICfAlzXXGasa3Vz/BencJR:A81Y4vev7MRklbbKcJR
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-