General
-
Target
Debit Note.doc
-
Size
23KB
-
Sample
230124-s6gy4scd54
-
MD5
f84ce914a6c913fd32119823d456b5d2
-
SHA1
9d9c7ae03fb2ae3c1bd86077008e95a982a0471a
-
SHA256
4e1c9dafeb733168680cfb000a4bf023e0851b1ee250dcf66677ff92cfa7387d
-
SHA512
93eddabf951fca0a3945611fc8380743cb13a4256804b976d46d551e48cbf7ef7ef728fa6f9f759be3e993ea72282442ab05da91a603ee626083c63a2fd1ad70
-
SSDEEP
384:KQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZ4y4hPTORhvw5MZKlNTd:GFx0XaIsnPRIa4fwJMfu6RhwuW5
Static task
static1
Behavioral task
behavioral1
Sample
Debit Note.rtf
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Debit Note.rtf
Resource
win10v2004-20221111-en
Malware Config
Extracted
lokibot
http://171.22.30.147/kelly/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Debit Note.doc
-
Size
23KB
-
MD5
f84ce914a6c913fd32119823d456b5d2
-
SHA1
9d9c7ae03fb2ae3c1bd86077008e95a982a0471a
-
SHA256
4e1c9dafeb733168680cfb000a4bf023e0851b1ee250dcf66677ff92cfa7387d
-
SHA512
93eddabf951fca0a3945611fc8380743cb13a4256804b976d46d551e48cbf7ef7ef728fa6f9f759be3e993ea72282442ab05da91a603ee626083c63a2fd1ad70
-
SSDEEP
384:KQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZ4y4hPTORhvw5MZKlNTd:GFx0XaIsnPRIa4fwJMfu6RhwuW5
Score10/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-