General
-
Target
PO 02 Nos of Cisco SG350-10P.exe
-
Size
659KB
-
Sample
230127-vejdzacb88
-
MD5
11ffa3a47aca2c79f21491133aae4998
-
SHA1
32fadced669e478ac7cebaf89326c044643c0ab3
-
SHA256
1dcf89460236ab5e2c0e1763060eb6c4d1fc4c7dee01a42f319bef157c8a33df
-
SHA512
db4f713d1f08c356a062f893abd15a0cbefb9d8d1cb59e5ef0a92f0c8abd5ceb35985d4cc26ac8341c1fd9abbb291d982f43059079e620fdab65ae819c8a5311
-
SSDEEP
12288:Ch7P8XvnkgfgK/EjTUKZdr/8RQJ8WnpyjnKurd9cnfXW:ChUvkgfR8jT5918Ape/
Static task
static1
Behavioral task
behavioral1
Sample
PO 02 Nos of Cisco SG350-10P.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PO 02 Nos of Cisco SG350-10P.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
lokibot
http://171.22.30.164/sharon/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
PO 02 Nos of Cisco SG350-10P.exe
-
Size
659KB
-
MD5
11ffa3a47aca2c79f21491133aae4998
-
SHA1
32fadced669e478ac7cebaf89326c044643c0ab3
-
SHA256
1dcf89460236ab5e2c0e1763060eb6c4d1fc4c7dee01a42f319bef157c8a33df
-
SHA512
db4f713d1f08c356a062f893abd15a0cbefb9d8d1cb59e5ef0a92f0c8abd5ceb35985d4cc26ac8341c1fd9abbb291d982f43059079e620fdab65ae819c8a5311
-
SSDEEP
12288:Ch7P8XvnkgfgK/EjTUKZdr/8RQJ8WnpyjnKurd9cnfXW:ChUvkgfR8jT5918Ape/
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-