General
-
Target
a3c7d60f19310f7dbecce1acba480a79cc7d7839aed4467bdd3eb374bfcd68eb.zip
-
Size
263KB
-
Sample
230208-ly6tyaab45
-
MD5
68d0670cba76a4ee36a1fb0f79477aef
-
SHA1
de701fa6b68899a9b9d077226700caf5754da023
-
SHA256
46bd02642e2967e0bcd318049143fb4b6bbcf3adac5c436dcc5604107ef5b494
-
SHA512
da26e58f50d98dafe1510cff15d168ade298bc143f053ed80515337b634f0b5e2de54df24b7679c556b78d030375b989ab3f526784db2e454514200ef6ed7130
-
SSDEEP
6144:66EMOVuh1+8F97vR5qvhxsDibCXHhfS+8ebeFzbsbtD:60OVdC55qZ+ObCXBx8eEbkD
Static task
static1
Behavioral task
behavioral1
Sample
a3c7d60f19310f7dbecce1acba480a79cc7d7839aed4467bdd3eb374bfcd68eb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a3c7d60f19310f7dbecce1acba480a79cc7d7839aed4467bdd3eb374bfcd68eb.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
lokibot
https://sempersim.su/ha12/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
a3c7d60f19310f7dbecce1acba480a79cc7d7839aed4467bdd3eb374bfcd68eb.exe
-
Size
344KB
-
MD5
8ed4cf27c1633d3c25e6980f5ee8d8fa
-
SHA1
10565a5953569a1657afa4873401e2d8e8940f2b
-
SHA256
a3c7d60f19310f7dbecce1acba480a79cc7d7839aed4467bdd3eb374bfcd68eb
-
SHA512
4296e8bb86e2b6cfbedc8fe856bd66956cf1a6688ba1d19d9ccaae5544f62daf866329ab35bf20d541e7a161b21163c4f61346828cc923138ce4509a98447a7d
-
SSDEEP
6144:8Ya6O4eRhQ9sVnQxU1vg8eE9N43l6lE/Ml6yZq0Shc8PGzAZ:8Y1eRh3nWUJg8eE99l6Uq0Shc/zC
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-