General
-
Target
DHL Package Delivery_pdf.exe
-
Size
151KB
-
Sample
221128-jeqbqsbe5y
-
MD5
dbd18643a6a8735d4c55d8685e33efcf
-
SHA1
74c6c5a85f2beda5cc3861ab2d46218347befedd
-
SHA256
fa01fdd6292fcef825f90489c643e62e1afc4c001eea7e2999bb813b7ca72a78
-
SHA512
ee54aa3d770d1e379c1f007977aea2879ad5ba8498706db124b9f2febc907242a29dbb37d6fd34113ca40ccb4a2d82d99673fc85490b78cf2b8b68aee1231649
-
SSDEEP
3072:xEhKzShSycKBoM2ExrKYtzf1mkXDF7WhjncOQ/E2HHRAWL:xBnQ2lYRtDJWNndQBHHRAWL
Static task
static1
Behavioral task
behavioral1
Sample
DHL Package Delivery_pdf.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
DHL Package Delivery_pdf.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
lokibot
http://171.22.30.164/kin/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
DHL Package Delivery_pdf.exe
-
Size
151KB
-
MD5
dbd18643a6a8735d4c55d8685e33efcf
-
SHA1
74c6c5a85f2beda5cc3861ab2d46218347befedd
-
SHA256
fa01fdd6292fcef825f90489c643e62e1afc4c001eea7e2999bb813b7ca72a78
-
SHA512
ee54aa3d770d1e379c1f007977aea2879ad5ba8498706db124b9f2febc907242a29dbb37d6fd34113ca40ccb4a2d82d99673fc85490b78cf2b8b68aee1231649
-
SSDEEP
3072:xEhKzShSycKBoM2ExrKYtzf1mkXDF7WhjncOQ/E2HHRAWL:xBnQ2lYRtDJWNndQBHHRAWL
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-