General
-
Target
de24beaedb6056767d3648c23bcfcdacf5925bc49072ee8c9e6e68a70a001fb8
-
Size
427KB
-
Sample
230129-x9kavscd7z
-
MD5
5a5eb9aad74bf798bf50c470e38a8c25
-
SHA1
96f6e39b7c16eb74fcfe9745631b26909c6d3ff0
-
SHA256
de24beaedb6056767d3648c23bcfcdacf5925bc49072ee8c9e6e68a70a001fb8
-
SHA512
58605c3f8290250698889bbcb459ee82b51d72be9e64498d20de9dccc54e812fea4bbd627f09c18afbb9766319d61350d645021fc7cb4180a28fc501a502d00e
-
SSDEEP
6144:6rmbYS9j7tCiyEKZm63z9EZgVY+RvNh2qZwBA+R8HsIsrDlAZUUryjzvaKDc8WxB:6CbYQjoiuN3JRh2ow9bFAZnrezf1f+x
Static task
static1
Behavioral task
behavioral1
Sample
de24beaedb6056767d3648c23bcfcdacf5925bc49072ee8c9e6e68a70a001fb8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
de24beaedb6056767d3648c23bcfcdacf5925bc49072ee8c9e6e68a70a001fb8.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
lokibot
http://51.195.53.221/p.php/syPLR31sAspbS
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
de24beaedb6056767d3648c23bcfcdacf5925bc49072ee8c9e6e68a70a001fb8
-
Size
427KB
-
MD5
5a5eb9aad74bf798bf50c470e38a8c25
-
SHA1
96f6e39b7c16eb74fcfe9745631b26909c6d3ff0
-
SHA256
de24beaedb6056767d3648c23bcfcdacf5925bc49072ee8c9e6e68a70a001fb8
-
SHA512
58605c3f8290250698889bbcb459ee82b51d72be9e64498d20de9dccc54e812fea4bbd627f09c18afbb9766319d61350d645021fc7cb4180a28fc501a502d00e
-
SSDEEP
6144:6rmbYS9j7tCiyEKZm63z9EZgVY+RvNh2qZwBA+R8HsIsrDlAZUUryjzvaKDc8WxB:6CbYQjoiuN3JRh2ow9bFAZnrezf1f+x
Score10/10-
Beds Protector Packer
Detects Beds Protector packer used to load .NET malware.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-