General
-
Target
1b737b1d7a9cd4c45062f541952e13b9b9af313ca6377a85b36bb77146a6626b.zip
-
Size
672KB
-
Sample
230208-ly6tyaab44
-
MD5
5845e39f698a85ba30f82669dc20d114
-
SHA1
776e66123c9d58ccac1c33fb38a6a2b687f0ab8d
-
SHA256
404f07e7dd5633634990611944a898c3de485365daa0a460d253ad147ba561d6
-
SHA512
d5278ede41b1ef1062360da94236568722213c8309f995add5b8864a2b74f155e8ff931ec489b2cd268699feda6d0dbd4d1415a46827f9985ae484d3db56481b
-
SSDEEP
12288:1vJESRbu1oLEEv7mAbunZt6XFs8yhFXJ10+dIXH:1vJEIrbmAbur6V2FXL0+23
Static task
static1
Behavioral task
behavioral1
Sample
1b737b1d7a9cd4c45062f541952e13b9b9af313ca6377a85b36bb77146a6626b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1b737b1d7a9cd4c45062f541952e13b9b9af313ca6377a85b36bb77146a6626b.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
lokibot
http://171.22.30.147/gk1/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
1b737b1d7a9cd4c45062f541952e13b9b9af313ca6377a85b36bb77146a6626b.exe
-
Size
702KB
-
MD5
e6572de46de2816451d6d411894cd600
-
SHA1
39b28168243e5923161e38749b062d0b502e8684
-
SHA256
1b737b1d7a9cd4c45062f541952e13b9b9af313ca6377a85b36bb77146a6626b
-
SHA512
9c4583c7b9226104ffae8686a054ee0d6ac753005d41ddb7034a70e27c067b09ab5d992bc3e49af2006c7f906f063fcf60e3cf36932971ecb836aacec4fce153
-
SSDEEP
12288:6pkePAIE/fEQWOrgoIoZTGzUdVYijJ3KeC1ZhcXnyXx6q16ahRZ5G:QAH/fzdrgEGMVDjJxC1H1NMS5G
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-