General
-
Target
r2023539611DMO1_S__PAR____UGURPASLANMAZAS_pdf.exe
-
Size
717KB
-
Sample
230922-bt3xdade93
-
MD5
cba967fec8e6a655702268799e1a387b
-
SHA1
b23b571046a002d65bc52a68ce44d2b0569733db
-
SHA256
6648d6be85d4611f71fb27b7598df56516c433bfe8fd51a1069bfbf1c8be0c29
-
SHA512
0fa6e4f3274ea2c35782d255e3c7dd01c7c74d9c52f4e38bd61abc402d2b869870c4199fdaeac93c29b6248c98758d72377643663008c2c683c61f8924ae5eb2
-
SSDEEP
6144:gxytz3T4ZkBjkbNNhNHG+96+BMfw+N/Zsl42sWZxc9Ki:gxM3TPBjkbNNbmGFj4zWnco
Static task
static1
Behavioral task
behavioral1
Sample
r2023539611DMO1_S__PAR____UGURPASLANMAZAS_pdf.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
r2023539611DMO1_S__PAR____UGURPASLANMAZAS_pdf.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
lokibot
http://ugopounds.caesarsgroup.top/_errorpages/ugopounds/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
r2023539611DMO1_S__PAR____UGURPASLANMAZAS_pdf.exe
-
Size
717KB
-
MD5
cba967fec8e6a655702268799e1a387b
-
SHA1
b23b571046a002d65bc52a68ce44d2b0569733db
-
SHA256
6648d6be85d4611f71fb27b7598df56516c433bfe8fd51a1069bfbf1c8be0c29
-
SHA512
0fa6e4f3274ea2c35782d255e3c7dd01c7c74d9c52f4e38bd61abc402d2b869870c4199fdaeac93c29b6248c98758d72377643663008c2c683c61f8924ae5eb2
-
SSDEEP
6144:gxytz3T4ZkBjkbNNhNHG+96+BMfw+N/Zsl42sWZxc9Ki:gxM3TPBjkbNNbmGFj4zWnco
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-