General
-
Target
SWIFT Transfer 103 LD9081.doc
-
Size
28KB
-
Sample
230124-s6gncaea4x
-
MD5
b46e00e44324f90a797dae714a4cc7d4
-
SHA1
358154f88d48d0b09a1a0b2dd1b01c1d24c61642
-
SHA256
b9ef91015d894ef785bbba54bd741d73866c7b5a4583ec87c470d748399f9ffd
-
SHA512
414119d0b1c75813eb7da3c3a50ad703e992635ae7680a7b274fd794019e53bb762af9a0924ac92ce4bd5b28528d06c644eb7ac947880db500c2988b59cec1a1
-
SSDEEP
768:VFx0XaIsnPRIa4fwJMCpDxpcQ2pxSGB/qd1CJs:Vf0Xvx3EMCGQyxoq+
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT Transfer 103 LD9081.rtf
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
SWIFT Transfer 103 LD9081.rtf
Resource
win10v2004-20220901-en
Malware Config
Extracted
lokibot
http://171.22.30.147/cody/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
SWIFT Transfer 103 LD9081.doc
-
Size
28KB
-
MD5
b46e00e44324f90a797dae714a4cc7d4
-
SHA1
358154f88d48d0b09a1a0b2dd1b01c1d24c61642
-
SHA256
b9ef91015d894ef785bbba54bd741d73866c7b5a4583ec87c470d748399f9ffd
-
SHA512
414119d0b1c75813eb7da3c3a50ad703e992635ae7680a7b274fd794019e53bb762af9a0924ac92ce4bd5b28528d06c644eb7ac947880db500c2988b59cec1a1
-
SSDEEP
768:VFx0XaIsnPRIa4fwJMCpDxpcQ2pxSGB/qd1CJs:Vf0Xvx3EMCGQyxoq+
Score10/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-