General
-
Target
xmwIOV9lPwSJpGz.exe
-
Size
605KB
-
Sample
221126-vt9jpsba58
-
MD5
d530510ab1fbe3e865674c0dddcffcd6
-
SHA1
e607f375f5556820a6241a7e9504fbc5cad5cf89
-
SHA256
1a00fa9d6e02bd8ce2c04443cbbf43119e390f32e1d6986933e9895e8d7ddef8
-
SHA512
002d4da605960cf18a878c5aa661d0ca954da3be56899057fc92c39bdee014a597b6fa531554ae4f01903573009b0816031f71ee34da21477635c971080fedbb
-
SSDEEP
12288:DZMygh/PsZ1DX/VDJuMZe1OVJDkhtk3FxT5oToL:iygh/PXke1OTgtkVp
Static task
static1
Behavioral task
behavioral1
Sample
xmwIOV9lPwSJpGz.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
xmwIOV9lPwSJpGz.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
lokibot
http://sempersim.su/gm10/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
xmwIOV9lPwSJpGz.exe
-
Size
605KB
-
MD5
d530510ab1fbe3e865674c0dddcffcd6
-
SHA1
e607f375f5556820a6241a7e9504fbc5cad5cf89
-
SHA256
1a00fa9d6e02bd8ce2c04443cbbf43119e390f32e1d6986933e9895e8d7ddef8
-
SHA512
002d4da605960cf18a878c5aa661d0ca954da3be56899057fc92c39bdee014a597b6fa531554ae4f01903573009b0816031f71ee34da21477635c971080fedbb
-
SSDEEP
12288:DZMygh/PsZ1DX/VDJuMZe1OVJDkhtk3FxT5oToL:iygh/PXke1OTgtkVp
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-