General
-
Target
de05f9c2ad13c543d4425f070e4608b37aac0b6d25c3816a8fd683cd8795a4b9
-
Size
339KB
-
Sample
230116-xq61hsfh31
-
MD5
21f218355048519cbfe30b197a9ed5bb
-
SHA1
ccb176d3bbea60567dc52439ffc0c127fa6eacc4
-
SHA256
de05f9c2ad13c543d4425f070e4608b37aac0b6d25c3816a8fd683cd8795a4b9
-
SHA512
33e88f9b1f374c0c0ac4230876c661a2b4cf05de5b2d1dea46e5f55e4a6644532a95442b74d1e854e9036f9acd2f3c8c1825defcd450cf72fa468529e1feafdf
-
SSDEEP
3072:4fY/TU9fE9PEtuABKs4fOzqEbeSgikfcIwVN2lQ7+TZe1tnlDcnvGyNWLHgdzMlx:uYa6KMwqGrgihpQstanvGyNWLHiQQBDU
Static task
static1
Behavioral task
behavioral1
Sample
de05f9c2ad13c543d4425f070e4608b37aac0b6d25c3816a8fd683cd8795a4b9.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
lokibot
https://sempersim.su/ha3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
de05f9c2ad13c543d4425f070e4608b37aac0b6d25c3816a8fd683cd8795a4b9
-
Size
339KB
-
MD5
21f218355048519cbfe30b197a9ed5bb
-
SHA1
ccb176d3bbea60567dc52439ffc0c127fa6eacc4
-
SHA256
de05f9c2ad13c543d4425f070e4608b37aac0b6d25c3816a8fd683cd8795a4b9
-
SHA512
33e88f9b1f374c0c0ac4230876c661a2b4cf05de5b2d1dea46e5f55e4a6644532a95442b74d1e854e9036f9acd2f3c8c1825defcd450cf72fa468529e1feafdf
-
SSDEEP
3072:4fY/TU9fE9PEtuABKs4fOzqEbeSgikfcIwVN2lQ7+TZe1tnlDcnvGyNWLHgdzMlx:uYa6KMwqGrgihpQstanvGyNWLHiQQBDU
Score10/10-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-