General
-
Target
SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe
-
Size
306KB
-
Sample
221129-s9bw9sch72
-
MD5
3039fa7b347872c33c247581a27a7560
-
SHA1
69832bbe446653f7d10eccf07069e73230138af8
-
SHA256
f949fda96d4810c4ffa941ecce00160b984cf7ac32cf1ca88dd4dd9583f2e480
-
SHA512
175e3f5c4bb39e490c2b25f02e623317923b02f976f7dfc029d0213ca5d3ef2b31deef01fd9a355fdf8d5eea826130e56e45723ab2004d3797de4e11cd4053d2
-
SSDEEP
1536:rLc62Vr2beD+oPKjg7cMpdLVPZby1U/r3EVi6DXxhoa:12VCkVUXL
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
lokibot
http://sedesadre.gq/PKZ/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe
-
Size
306KB
-
MD5
3039fa7b347872c33c247581a27a7560
-
SHA1
69832bbe446653f7d10eccf07069e73230138af8
-
SHA256
f949fda96d4810c4ffa941ecce00160b984cf7ac32cf1ca88dd4dd9583f2e480
-
SHA512
175e3f5c4bb39e490c2b25f02e623317923b02f976f7dfc029d0213ca5d3ef2b31deef01fd9a355fdf8d5eea826130e56e45723ab2004d3797de4e11cd4053d2
-
SSDEEP
1536:rLc62Vr2beD+oPKjg7cMpdLVPZby1U/r3EVi6DXxhoa:12VCkVUXL
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-