General
-
Target
b22d8fdd97f45f4dfdd1bfb3ffebbd4e.exe
-
Size
652KB
-
Sample
230610-klgtlsed56
-
MD5
b22d8fdd97f45f4dfdd1bfb3ffebbd4e
-
SHA1
8e795a42ef5eac5a161c8cea9008f1fd07f342a9
-
SHA256
f02eb95bab7a8ecdc3b8d757c3132176f1a172161a999c3eaf15ed2ab3bc75f0
-
SHA512
1b2ead364470562e7e0152065e3caedcd2d09db11458515f4ade2592cfecfdb8876a89231f544dad05a622f0c1f21b80112b5627c25ac52c089f1b537e861d35
-
SSDEEP
12288:fu+J/M+Jhewx/NscEQ+vgXK1HsaPTMf8d+Bjpt2WN4Ej8GHamX3Qv+J:f3/thewlqB6p8Mf3xptd8G6mX3/
Static task
static1
Behavioral task
behavioral1
Sample
b22d8fdd97f45f4dfdd1bfb3ffebbd4e.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b22d8fdd97f45f4dfdd1bfb3ffebbd4e.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
lokibot
http://161.35.102.56/~nikol/?p=7398172063
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
b22d8fdd97f45f4dfdd1bfb3ffebbd4e.exe
-
Size
652KB
-
MD5
b22d8fdd97f45f4dfdd1bfb3ffebbd4e
-
SHA1
8e795a42ef5eac5a161c8cea9008f1fd07f342a9
-
SHA256
f02eb95bab7a8ecdc3b8d757c3132176f1a172161a999c3eaf15ed2ab3bc75f0
-
SHA512
1b2ead364470562e7e0152065e3caedcd2d09db11458515f4ade2592cfecfdb8876a89231f544dad05a622f0c1f21b80112b5627c25ac52c089f1b537e861d35
-
SSDEEP
12288:fu+J/M+Jhewx/NscEQ+vgXK1HsaPTMf8d+Bjpt2WN4Ej8GHamX3Qv+J:f3/thewlqB6p8Mf3xptd8G6mX3/
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-