General
-
Target
hkcmd.exe
-
Size
656KB
-
Sample
230606-qatxpaec5s
-
MD5
a402dd613b2b1fb2b7f4b977a53762c3
-
SHA1
32c5e316b3669c309195a79fa476780b31ea711d
-
SHA256
cf2027d03fbff2de1d48b8e908a6161cb37014be0dd438fde844e872f5d0d8bf
-
SHA512
d96044e19250736638d13f8b838a6431c3209f60399564db58108a1c2bcd01a4b6e76ee311e50961800380df6c5b7762c976b74e976918639ef12120b843e7d7
-
SSDEEP
12288:DN+J/M+Jhewx/NscEQ+vgXK1HsaPDv87laM/cJLGELXKQB0+ET2lWArZr3tc9+J:O/thewlqB6pOv+lt/cYEJB0+EClWux33
Static task
static1
Behavioral task
behavioral1
Sample
hkcmd.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
hkcmd.exe
Resource
win7-20230220-en
Malware Config
Extracted
lokibot
http://194.180.48.58/morgan/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
hkcmd.exe
-
Size
656KB
-
MD5
a402dd613b2b1fb2b7f4b977a53762c3
-
SHA1
32c5e316b3669c309195a79fa476780b31ea711d
-
SHA256
cf2027d03fbff2de1d48b8e908a6161cb37014be0dd438fde844e872f5d0d8bf
-
SHA512
d96044e19250736638d13f8b838a6431c3209f60399564db58108a1c2bcd01a4b6e76ee311e50961800380df6c5b7762c976b74e976918639ef12120b843e7d7
-
SSDEEP
12288:DN+J/M+Jhewx/NscEQ+vgXK1HsaPDv87laM/cJLGELXKQB0+ET2lWArZr3tc9+J:O/thewlqB6pOv+lt/cYEJB0+EClWux33
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-