General
- Target SecuriteInfo.com.Win64.CrypterX-gen.28333.1102.exe
- Size 386KB
- Sample221122-e5ynksac86
- SHA256 8d7cb307a44963f336066c72cc019b6e35e28a7f9dec66f9ac673ced4181913e
- MD5 92b2c6f9fce76340126981d916e160b4
- SHA1 3bf2b7a4c19e52211bf52cbb7b9c051a9a4ff64e
- SHA512 443e9c7829b90128bc3f4a25475115e73887815ac0ee87cedf3f7acfca714e8dab7e883ca233c37d4d911365c978786d282396702eb2ca203fdee980f1633aa6
- SSDEEP 6144:dFFSn2xdF/UYH7m+5BgcoQahU0uNe9z7RJocCCy4ZPc6QTEfz36TaV:Hn6O7v4xQa7uNe9ZJo6h0NTE7f
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win64.CrypterX-gen.28333.1102.exe
Resource
win7-20220901-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win64.CrypterX-gen.28333.1102.exe
Resource
win10v2004-20221111-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://185.246.220.212/orange/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target SecuriteInfo.com.Win64.CrypterX-gen.28333.1102.exe
- Size 386KB
- SHA256 8d7cb307a44963f336066c72cc019b6e35e28a7f9dec66f9ac673ced4181913e
- MD5 92b2c6f9fce76340126981d916e160b4
- SHA1 3bf2b7a4c19e52211bf52cbb7b9c051a9a4ff64e
- SHA512 443e9c7829b90128bc3f4a25475115e73887815ac0ee87cedf3f7acfca714e8dab7e883ca233c37d4d911365c978786d282396702eb2ca203fdee980f1633aa6
- SSDEEP 6144:dFFSn2xdF/UYH7m+5BgcoQahU0uNe9z7RJocCCy4ZPc6QTEfz36TaV:Hn6O7v4xQa7uNe9ZJo6h0NTE7f
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext