General
-
Target
d2cd3274a7a1827a17b478b481f9e0f4
-
Size
750KB
-
Sample
240318-g5za8aac57
-
MD5
d2cd3274a7a1827a17b478b481f9e0f4
-
SHA1
7db9a82967ead20cdd22368767be14b104f9723f
-
SHA256
d5a03c57bae086a6428d6aae55d1518e74331236c24e65eb849298418b08e8dd
-
SHA512
e3e3e1bf2517accde49b395aa1ceec36295218f2d7e765fe80082a3a1aa3a2cea8cc88c932b6f1743feb73ab9272041be2983720874737515e9ae1fdfd1957bf
-
SSDEEP
12288:IoSDsLOijlOzAa1B3LjZg9ZWsQ4ihqVlxk1i2OZo3+3F7:IoSDVOlO8a1dEiuCFGP9
Static task
static1
Behavioral task
behavioral1
Sample
d2cd3274a7a1827a17b478b481f9e0f4.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
d2cd3274a7a1827a17b478b481f9e0f4.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
lokibot
http://185.227.139.5/sxisodifntose.php/YhXBwhqZTd6mE
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
d2cd3274a7a1827a17b478b481f9e0f4
-
Size
750KB
-
MD5
d2cd3274a7a1827a17b478b481f9e0f4
-
SHA1
7db9a82967ead20cdd22368767be14b104f9723f
-
SHA256
d5a03c57bae086a6428d6aae55d1518e74331236c24e65eb849298418b08e8dd
-
SHA512
e3e3e1bf2517accde49b395aa1ceec36295218f2d7e765fe80082a3a1aa3a2cea8cc88c932b6f1743feb73ab9272041be2983720874737515e9ae1fdfd1957bf
-
SSDEEP
12288:IoSDsLOijlOzAa1B3LjZg9ZWsQ4ihqVlxk1i2OZo3+3F7:IoSDVOlO8a1dEiuCFGP9
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-