General
-
Target
FedEx Receipt.exe
-
Size
717KB
-
Sample
230328-dlqyysae51
-
MD5
691ed4223b0a845fc048068552c788d7
-
SHA1
734df5ec875431573ce3d60adf8239c670db2105
-
SHA256
c5881aae0402696993a36546d2fa1e44d6fb53c0b8528ea23cbb1c12e0e7c9b1
-
SHA512
866beffb1a2175bee15580bc3cfe3652865a307cd35307c3dbbc11b860c731ca1183fec5cc6693c963dd7272e519659bfc5662eeab3fb5b3c51c47033b0dc68b
-
SSDEEP
12288:GLrKdJVZz5ddKjvQXiL01yTImFHAlMTb2WOrkXbHkVzrZ/uC:EgVZ9fsvQf16IcHAlMX2W3XLwsC
Static task
static1
Behavioral task
behavioral1
Sample
FedEx Receipt.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
FedEx Receipt.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
lokibot
http://64.227.48.212/?page_id=2621
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
FedEx Receipt.exe
-
Size
717KB
-
MD5
691ed4223b0a845fc048068552c788d7
-
SHA1
734df5ec875431573ce3d60adf8239c670db2105
-
SHA256
c5881aae0402696993a36546d2fa1e44d6fb53c0b8528ea23cbb1c12e0e7c9b1
-
SHA512
866beffb1a2175bee15580bc3cfe3652865a307cd35307c3dbbc11b860c731ca1183fec5cc6693c963dd7272e519659bfc5662eeab3fb5b3c51c47033b0dc68b
-
SSDEEP
12288:GLrKdJVZz5ddKjvQXiL01yTImFHAlMTb2WOrkXbHkVzrZ/uC:EgVZ9fsvQf16IcHAlMX2W3XLwsC
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-