General
-
Target
[External] Purchase Order from Telkomsel.exe
-
Size
483KB
-
Sample
240314-jca42adg7s
-
MD5
dbde6d96e328c169028b2673d4d89d27
-
SHA1
d3991b143298c33c56300595cc5b8c9ae870675d
-
SHA256
366c3e4f90b97f849ae44a2d0f6c6d78b9dab71582e3fbeca225180b39d589b3
-
SHA512
e85c0ba365dbfa8447eb4f5c8bbac5d236811e952f8ab223248067b958ca32e4242df66c3cbe2a3c1cf015cd90249f36e4b884c850a760326a0dac0c7d333ece
-
SSDEEP
12288:eTfGjfehmBjCtepTyqlf7cIm0XtTofGhqk1cS7EVw2XN:eTfGjsmBUoTRf7ZjtTdH1x7J2XN
Static task
static1
Behavioral task
behavioral1
Sample
[External] Purchase Order from Telkomsel.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
[External] Purchase Order from Telkomsel.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
lokibot
https://mauricioclopatofsky.tel/user/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
[External] Purchase Order from Telkomsel.exe
-
Size
483KB
-
MD5
dbde6d96e328c169028b2673d4d89d27
-
SHA1
d3991b143298c33c56300595cc5b8c9ae870675d
-
SHA256
366c3e4f90b97f849ae44a2d0f6c6d78b9dab71582e3fbeca225180b39d589b3
-
SHA512
e85c0ba365dbfa8447eb4f5c8bbac5d236811e952f8ab223248067b958ca32e4242df66c3cbe2a3c1cf015cd90249f36e4b884c850a760326a0dac0c7d333ece
-
SSDEEP
12288:eTfGjfehmBjCtepTyqlf7cIm0XtTofGhqk1cS7EVw2XN:eTfGjsmBUoTRf7ZjtTdH1x7J2XN
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-