General
-
Target
e2622576f7fbf2376495d92fbfd0b88e6c0c85073f71d548618f1111a75c9cf2
-
Size
655KB
-
Sample
240309-be4v5abg5v
-
MD5
0016e6c6a159ddfe7ee61e89632c39df
-
SHA1
08198ed5355fcb23c48949f1c2ed5c9de55807e3
-
SHA256
e2622576f7fbf2376495d92fbfd0b88e6c0c85073f71d548618f1111a75c9cf2
-
SHA512
6ba0e57c899b913703033ab5f604a72d5a1570d34a12bfb8e96acfa6df37879d6d59906e07d8fa8034039e205ff3e27c476ca7ac94e7a7c95fb5d53acaa855bd
-
SSDEEP
12288:GtRulXTWAFjMaqD3UZmJ44yXJJOk6ZfFK0sDGKV8t1t2NjFdFm:kuvFgaqA8JzGJcpIJV8t1MNjTFm
Static task
static1
Behavioral task
behavioral1
Sample
e2622576f7fbf2376495d92fbfd0b88e6c0c85073f71d548618f1111a75c9cf2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e2622576f7fbf2376495d92fbfd0b88e6c0c85073f71d548618f1111a75c9cf2.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
lokibot
http://185.227.139.18/dsaicosaicasdi.php/Ooq7cQ4IpHUWj
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
e2622576f7fbf2376495d92fbfd0b88e6c0c85073f71d548618f1111a75c9cf2
-
Size
655KB
-
MD5
0016e6c6a159ddfe7ee61e89632c39df
-
SHA1
08198ed5355fcb23c48949f1c2ed5c9de55807e3
-
SHA256
e2622576f7fbf2376495d92fbfd0b88e6c0c85073f71d548618f1111a75c9cf2
-
SHA512
6ba0e57c899b913703033ab5f604a72d5a1570d34a12bfb8e96acfa6df37879d6d59906e07d8fa8034039e205ff3e27c476ca7ac94e7a7c95fb5d53acaa855bd
-
SSDEEP
12288:GtRulXTWAFjMaqD3UZmJ44yXJJOk6ZfFK0sDGKV8t1t2NjFdFm:kuvFgaqA8JzGJcpIJV8t1MNjTFm
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-