General
-
Target
11ffa3a47aca2c79f21491133aae4998.bin
-
Size
504KB
-
Sample
230130-qcsseaad89
-
MD5
401e2bbcab81484442330426a5af04f5
-
SHA1
b2b0b7480034bcbfca482ec7b672fcf8feaf3307
-
SHA256
b67edd4891cfc92fda967229bc609e0ef48fb1297c894abf7c7b8d061ba246ef
-
SHA512
a252387bf0c987893f01795aa909268981d6b69ac83349ea25f94400b71d0580171c85fb56b15be13679336ff0f39684914ab74782cea25eedeaf4ed96942c89
-
SSDEEP
12288:63jkQ6oV01tjGNJJVbRA0RPo+3HUcbAGZdMrnExOjdAL7GB:6TrVKj2b9nRQ+3H0GZSddI7GB
Static task
static1
Behavioral task
behavioral1
Sample
1dcf89460236ab5e2c0e1763060eb6c4d1fc4c7dee01a42f319bef157c8a33df.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1dcf89460236ab5e2c0e1763060eb6c4d1fc4c7dee01a42f319bef157c8a33df.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
lokibot
http://171.22.30.164/sharon/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
1dcf89460236ab5e2c0e1763060eb6c4d1fc4c7dee01a42f319bef157c8a33df.exe
-
Size
659KB
-
MD5
11ffa3a47aca2c79f21491133aae4998
-
SHA1
32fadced669e478ac7cebaf89326c044643c0ab3
-
SHA256
1dcf89460236ab5e2c0e1763060eb6c4d1fc4c7dee01a42f319bef157c8a33df
-
SHA512
db4f713d1f08c356a062f893abd15a0cbefb9d8d1cb59e5ef0a92f0c8abd5ceb35985d4cc26ac8341c1fd9abbb291d982f43059079e620fdab65ae819c8a5311
-
SSDEEP
12288:Ch7P8XvnkgfgK/EjTUKZdr/8RQJ8WnpyjnKurd9cnfXW:ChUvkgfR8jT5918Ape/
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-