General
-
Target
a46c816dec5e5b223c312f3ef7ac24d0.bin
-
Size
347KB
-
Sample
230207-jeaahsab63
-
MD5
d20a26934b3b6993e70eb29ff4ff7ab8
-
SHA1
6a7ac0e1592c5bf15cdff432ca6a73f3044eb1d5
-
SHA256
188ae8a39fcba9c14e2cdad9c2df77a4585a1abf0be66d050d4282522d8a0076
-
SHA512
5e34eb5d40e48d9fc32dde8ba0847383b518d41d23c2baa1b1c50367b726a6640abe9d59411eb976a38a8123d20783949f80b1732b03b20f14461f24e44c07b1
-
SSDEEP
6144:NHH4HN6/dfffwO1s/9soCWjrCfFdSjEsG5zBt0I3qWuJuwSYKTr7Zv5tk:Z4HN0wOAG+f3Yb0I3qWQuDzRq
Static task
static1
Behavioral task
behavioral1
Sample
76508bec6db5bf37ec4d0ec301aa607b30aefd1ac0dc0a5ea91dcf12bf076ec6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
76508bec6db5bf37ec4d0ec301aa607b30aefd1ac0dc0a5ea91dcf12bf076ec6.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
lokibot
http://rhinestone.cc/obino/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
76508bec6db5bf37ec4d0ec301aa607b30aefd1ac0dc0a5ea91dcf12bf076ec6.exe
-
Size
550KB
-
MD5
a46c816dec5e5b223c312f3ef7ac24d0
-
SHA1
69d5efe2394c4a21bfeccee6aee69a12a06d31e9
-
SHA256
76508bec6db5bf37ec4d0ec301aa607b30aefd1ac0dc0a5ea91dcf12bf076ec6
-
SHA512
dd2159ffd4708583e8effc649d8ce3280fb5a968e1b253982020fb4922cc1a723b0d6f84875439c9d6db6e098b0b85f8d8aa497c947e9cd9ce2f34c6b80de293
-
SSDEEP
6144:fZXnyAZYtYUfe7xCQkGBb/A3LlkHWcA0I7uyMrtYty10DAgBjwSwDpL8CIHPLmWJ:fZXTjn+Ywf9zzC0Km3CjhRHjMylwt
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-