General
-
Target
baeff6fd1d98cbdac34f70ef9c9629eb
-
Size
1003KB
-
Sample
240308-lrfzyaca23
-
MD5
baeff6fd1d98cbdac34f70ef9c9629eb
-
SHA1
278ee5449845197c4042268f7cd464771868b2bd
-
SHA256
cc478ea768c646fc65f625ca2150a035bf5d75421e6cacdcc51736429b72f6ef
-
SHA512
a32d8df373e9882ed0ed47614c9220cff0bd5f8d977745663ed88efdfad30798ec4f680e80cf534fddab71632f47f4e529bbfe2c799f50dfebae4831faf5a3b0
-
SSDEEP
12288:esVCaHo2Ahe9TebuuSVppOsuqBSNntJoSh0zcl7Lw8qFX/N1fVNia+NRu6Db:XVnHo2A4dTpOsuqBstaQXw/NJKao
Static task
static1
Behavioral task
behavioral1
Sample
baeff6fd1d98cbdac34f70ef9c9629eb.exe
Resource
win7-20240221-en
Malware Config
Extracted
lokibot
http://185.227.139.18/dsaicosaicasdi.php/BXlnnQj8OAckh
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
baeff6fd1d98cbdac34f70ef9c9629eb
-
Size
1003KB
-
MD5
baeff6fd1d98cbdac34f70ef9c9629eb
-
SHA1
278ee5449845197c4042268f7cd464771868b2bd
-
SHA256
cc478ea768c646fc65f625ca2150a035bf5d75421e6cacdcc51736429b72f6ef
-
SHA512
a32d8df373e9882ed0ed47614c9220cff0bd5f8d977745663ed88efdfad30798ec4f680e80cf534fddab71632f47f4e529bbfe2c799f50dfebae4831faf5a3b0
-
SSDEEP
12288:esVCaHo2Ahe9TebuuSVppOsuqBSNntJoSh0zcl7Lw8qFX/N1fVNia+NRu6Db:XVnHo2A4dTpOsuqBstaQXw/NJKao
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-