General
-
Target
51078086db027c0bbfc2dac95552164f86d999dc8c18f7c93a14d237c428fac9
-
Size
587KB
-
Sample
230129-1fyg6sdf53
-
MD5
24decddfb98682ead23c5a7166d8ca7b
-
SHA1
e2b0e15d7faea644fd43a0626e08d9dab3c22f15
-
SHA256
51078086db027c0bbfc2dac95552164f86d999dc8c18f7c93a14d237c428fac9
-
SHA512
d0901c694b121d9634ac0fd2519a5c983187102f6d195516cb33a0fbd1caf6c732e9c2e930c4aa96efb8822a4912f17b9dc56572736b9ce21d3321981fd1f227
-
SSDEEP
12288:xAi6UCPFpsvFdQSwyi7fnuhJIE88bFIZ:8tp+lq98bFu
Static task
static1
Behavioral task
behavioral1
Sample
51078086db027c0bbfc2dac95552164f86d999dc8c18f7c93a14d237c428fac9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
51078086db027c0bbfc2dac95552164f86d999dc8c18f7c93a14d237c428fac9.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
lokibot
http://gaoshengfuruiture.com/baba/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
51078086db027c0bbfc2dac95552164f86d999dc8c18f7c93a14d237c428fac9
-
Size
587KB
-
MD5
24decddfb98682ead23c5a7166d8ca7b
-
SHA1
e2b0e15d7faea644fd43a0626e08d9dab3c22f15
-
SHA256
51078086db027c0bbfc2dac95552164f86d999dc8c18f7c93a14d237c428fac9
-
SHA512
d0901c694b121d9634ac0fd2519a5c983187102f6d195516cb33a0fbd1caf6c732e9c2e930c4aa96efb8822a4912f17b9dc56572736b9ce21d3321981fd1f227
-
SSDEEP
12288:xAi6UCPFpsvFdQSwyi7fnuhJIE88bFIZ:8tp+lq98bFu
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-