General
-
Target
tmp
-
Size
1.0MB
-
Sample
221123-hyf2qsab2s
-
MD5
3fd686dda4278442282f8789505bdfb6
-
SHA1
15aa3c3116ac412a79813fc9f1e83b21042be13c
-
SHA256
e8c74e6a2ced015f37ed7d4da6ab48d8abccbcf9a580fc868fc9462aaac4ecca
-
SHA512
67a9b2946b4945ac1761ead61c4126fc4f00fdaa68a34ebc073b6e36dfaca38aafaa9e5ff320574ca0a869093ac2026d13d008820645ebdf3b5a34d3a45ddc35
-
SSDEEP
24576:u/G9Kv5YZKKT6kXH8CE2G2AW3vNyCbVqdOp:d9KvWZXcCE2GJW3vxxqdO
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
lokibot
http://sempersim.su/gm4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
tmp
-
Size
1.0MB
-
MD5
3fd686dda4278442282f8789505bdfb6
-
SHA1
15aa3c3116ac412a79813fc9f1e83b21042be13c
-
SHA256
e8c74e6a2ced015f37ed7d4da6ab48d8abccbcf9a580fc868fc9462aaac4ecca
-
SHA512
67a9b2946b4945ac1761ead61c4126fc4f00fdaa68a34ebc073b6e36dfaca38aafaa9e5ff320574ca0a869093ac2026d13d008820645ebdf3b5a34d3a45ddc35
-
SSDEEP
24576:u/G9Kv5YZKKT6kXH8CE2G2AW3vNyCbVqdOp:d9KvWZXcCE2GJW3vxxqdO
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-