General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.30700.766
-
Size
652KB
-
Sample
230606-d2wt5sbh44
-
MD5
bc9e1583a7eeaa2d6ca381a58fd52324
-
SHA1
f92665cfde2b367f6185850aad7cafed4b247281
-
SHA256
94a92d06d9fac7101cb5c15f1afe2bce92b2186085cadc1ea2c72b2f6e154912
-
SHA512
b0709916b72426125317a82f1cc5e829630b2701ec13e6ddb5b74c9e3e64bb476481ac1f90fef9d8b2d92859725446bd44267ebc8aa38ef43d717d9e392fb918
-
SSDEEP
12288:7+J/M+Jhewx/NscEQ+vgXK1HsaPIyq6dUe4XL6fzvStNUrNYJm2myM609M+J:Y/thewlqB6pheQIStVJ0yM6At
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.30700.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.PWSX-gen.30700.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
lokibot
http://171.22.30.147/zino/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
SecuriteInfo.com.Win32.PWSX-gen.30700.766
-
Size
652KB
-
MD5
bc9e1583a7eeaa2d6ca381a58fd52324
-
SHA1
f92665cfde2b367f6185850aad7cafed4b247281
-
SHA256
94a92d06d9fac7101cb5c15f1afe2bce92b2186085cadc1ea2c72b2f6e154912
-
SHA512
b0709916b72426125317a82f1cc5e829630b2701ec13e6ddb5b74c9e3e64bb476481ac1f90fef9d8b2d92859725446bd44267ebc8aa38ef43d717d9e392fb918
-
SSDEEP
12288:7+J/M+Jhewx/NscEQ+vgXK1HsaPIyq6dUe4XL6fzvStNUrNYJm2myM609M+J:Y/thewlqB6pheQIStVJ0yM6At
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-