General
-
Target
ihihihihihihihihihihihi###################ihihihihihiihihi.doc
-
Size
22KB
-
Sample
230606-qac9yaec41
-
MD5
85475ae524d666b495d8829a391559a3
-
SHA1
b38dc5814b8b25ca2b7072f5c9e9f5dbcb303bd3
-
SHA256
2c92a73b2a1944edc54c6b9858aff4bea347c7ec32f28367dca613479ea77ca8
-
SHA512
0944d414134651d09d19aac6e0f3eb88e694599cf02697ae464b0d88418fcec2847e53fb8c27c7bd5221c4b539feba9b4682903ac14df98cddc1923b40f77b8b
-
SSDEEP
384:rBKimpXzcVhZH4pnxcsxJltKgKC3VBnB3+JM6hAYZRdKScbpm39w0Jo/F0jCixvS:VmpXzghZH4dxcsxhKJC3Vf3+dvSbpSon
Static task
static1
Behavioral task
behavioral1
Sample
ihihihihihihihihihihihi###################ihihihihihiihihi.rtf
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
ihihihihihihihihihihihi###################ihihihihihiihihi.rtf
Resource
win7-20230220-en
Malware Config
Extracted
lokibot
http://194.180.48.58/morgan/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
ihihihihihihihihihihihi###################ihihihihihiihihi.doc
-
Size
22KB
-
MD5
85475ae524d666b495d8829a391559a3
-
SHA1
b38dc5814b8b25ca2b7072f5c9e9f5dbcb303bd3
-
SHA256
2c92a73b2a1944edc54c6b9858aff4bea347c7ec32f28367dca613479ea77ca8
-
SHA512
0944d414134651d09d19aac6e0f3eb88e694599cf02697ae464b0d88418fcec2847e53fb8c27c7bd5221c4b539feba9b4682903ac14df98cddc1923b40f77b8b
-
SSDEEP
384:rBKimpXzcVhZH4pnxcsxJltKgKC3VBnB3+JM6hAYZRdKScbpm39w0Jo/F0jCixvS:VmpXzghZH4dxcsxhKJC3Vf3+dvSbpSon
Score10/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-