General
-
Target
ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1
-
Size
353KB
-
Sample
240305-jpeb8aaa5s
-
MD5
ae4219dc1d5bd6f693cc75c135539ce4
-
SHA1
377b8aafc18502fa2e7430e5bca79a411aaac5ef
-
SHA256
ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1
-
SHA512
2e2bfb3e7d38e0025b4e7849943e3bedad9c5daa0713b66dfaeda615544d5e3963a44bc1221a7a95d09201161a49cf5dba285f4114bc4193154b5dfac03926ed
-
SSDEEP
6144:E9Y/0Vkb4LFo2yXafnftfjmBaIEtUYvlkUEL8BhAe2qQQuYP4Lb+nxpddhRI:Z/wzFo2LnfzIE6ulZxh+3YPG+nxpddhK
Static task
static1
Behavioral task
behavioral1
Sample
ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
lokibot
http://91.92.252.146:8015/wioy/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1
-
Size
353KB
-
MD5
ae4219dc1d5bd6f693cc75c135539ce4
-
SHA1
377b8aafc18502fa2e7430e5bca79a411aaac5ef
-
SHA256
ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1
-
SHA512
2e2bfb3e7d38e0025b4e7849943e3bedad9c5daa0713b66dfaeda615544d5e3963a44bc1221a7a95d09201161a49cf5dba285f4114bc4193154b5dfac03926ed
-
SSDEEP
6144:E9Y/0Vkb4LFo2yXafnftfjmBaIEtUYvlkUEL8BhAe2qQQuYP4Lb+nxpddhRI:Z/wzFo2LnfzIE6ulZxh+3YPG+nxpddhK
Score10/10-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables containing common artifacts observed in infostealers
-
Detects executables packed with ConfuserEx Mod
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-