General
-
Target
05108399.exe
-
Size
724KB
-
Sample
230607-pbenqaaf4w
-
MD5
c32ebe58adc734406f4608fdbe7c9026
-
SHA1
a1ef6fb3ddc91d42d6eb356aaef0e283787a94d5
-
SHA256
936b0a2add95132c07e4bc7ab3864171e397b5917bf193f7ff99484c2058816c
-
SHA512
686172df2843075ec44c8d47f0b032312e6e4388ba7153529ec095c9e9c9ad7a888a4b0db1ab1a343033236a2fe7675c463dcdead28f34986e5e9b42fb0feb20
-
SSDEEP
12288:DUlRuW3haDnLMzIL2q+RTdOL8CK9Qw5T7lQPWJva+B+V2tfTwL8e+Bd:DUlRuUOyqGUL8r9D5flQeJrB7ta8e
Static task
static1
Behavioral task
behavioral1
Sample
05108399.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
05108399.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
lokibot
http://161.35.102.56/~nikol/?p=882166721559
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
05108399.exe
-
Size
724KB
-
MD5
c32ebe58adc734406f4608fdbe7c9026
-
SHA1
a1ef6fb3ddc91d42d6eb356aaef0e283787a94d5
-
SHA256
936b0a2add95132c07e4bc7ab3864171e397b5917bf193f7ff99484c2058816c
-
SHA512
686172df2843075ec44c8d47f0b032312e6e4388ba7153529ec095c9e9c9ad7a888a4b0db1ab1a343033236a2fe7675c463dcdead28f34986e5e9b42fb0feb20
-
SSDEEP
12288:DUlRuW3haDnLMzIL2q+RTdOL8CK9Qw5T7lQPWJva+B+V2tfTwL8e+Bd:DUlRuUOyqGUL8r9D5flQeJrB7ta8e
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-