General
-
Target
8a86ecf19e44fdb01bebd049066ae5ec.exe
-
Size
726KB
-
Sample
230207-ekm2cacd9s
-
MD5
8a86ecf19e44fdb01bebd049066ae5ec
-
SHA1
7be3fa1a92526cce784e8ba0f06f0183448dd5a7
-
SHA256
3c74c849a09e708972e0dd3b46cd9f583059f8f5cd9d3f2db5bd3a9b8a788c41
-
SHA512
eed9861b59a46e4bafe3931dc0ffbe3e95bd30b7208755544c7e721579e1f38aaf5c9d3dceb8868cd3a0010bff851630cef1a9ef2d7c02a5a7a51e8d4ea7941d
-
SSDEEP
12288:31MPA3bSkmtgIXHDiwOtUeQ9B7Nusv3ZV+hliQdRIOrx7p58lCrd4gyQapWMsN:6A3b++FQrV3ZwliQdrxN5IC54TWMa
Static task
static1
Behavioral task
behavioral1
Sample
8a86ecf19e44fdb01bebd049066ae5ec.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8a86ecf19e44fdb01bebd049066ae5ec.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
lokibot
https://sempersim.su/ha4/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
8a86ecf19e44fdb01bebd049066ae5ec.exe
-
Size
726KB
-
MD5
8a86ecf19e44fdb01bebd049066ae5ec
-
SHA1
7be3fa1a92526cce784e8ba0f06f0183448dd5a7
-
SHA256
3c74c849a09e708972e0dd3b46cd9f583059f8f5cd9d3f2db5bd3a9b8a788c41
-
SHA512
eed9861b59a46e4bafe3931dc0ffbe3e95bd30b7208755544c7e721579e1f38aaf5c9d3dceb8868cd3a0010bff851630cef1a9ef2d7c02a5a7a51e8d4ea7941d
-
SSDEEP
12288:31MPA3bSkmtgIXHDiwOtUeQ9B7Nusv3ZV+hliQdRIOrx7p58lCrd4gyQapWMsN:6A3b++FQrV3ZwliQdrxN5IC54TWMa
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-