General
- Target e8a59b068f08284eb4159afadb10110e.exe
- Size 745KB
- Sample230714-mc3qtsdb72
- SHA256 a8a93db6e6885ea5c0b78da837d5ff47982edaabb63588fd2e032ba68e51ad4f
- MD5 e8a59b068f08284eb4159afadb10110e
- SHA1 96d4920b387899eaaf1626075a9cf3c7def9372f
- SHA512 bc6e5682635ad8df23e0b6f2e945b019fa12b9980326a659a53ce90e5651e018f452c56edafa32697f9d3eeacf1d80dc5b49dd06a9de1069d0e42fdbd7f49ab9
- SSDEEP 12288:vh1Lk70TnvjcY8Rm+PXUcc5ozRyl6L7cM5drJmkQ/qbKL0sbqX/JF77lKw6sWG:Lk70TrcMYUc+of/c+/RvsuJTx6PG
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
e8a59b068f08284eb4159afadb10110e.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
e8a59b068f08284eb4159afadb10110e.exe
Resource
win10v2004-20230703-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://185.246.220.60/sweetwhore/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target e8a59b068f08284eb4159afadb10110e.exe
- Size 745KB
- SHA256 a8a93db6e6885ea5c0b78da837d5ff47982edaabb63588fd2e032ba68e51ad4f
- MD5 e8a59b068f08284eb4159afadb10110e
- SHA1 96d4920b387899eaaf1626075a9cf3c7def9372f
- SHA512 bc6e5682635ad8df23e0b6f2e945b019fa12b9980326a659a53ce90e5651e018f452c56edafa32697f9d3eeacf1d80dc5b49dd06a9de1069d0e42fdbd7f49ab9
- SSDEEP 12288:vh1Lk70TnvjcY8Rm+PXUcc5ozRyl6L7cM5drJmkQ/qbKL0sbqX/JF77lKw6sWG:Lk70TrcMYUc+of/c+/RvsuJTx6PG
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext