General
-
Target
d5939c8c1bb766426cbde9b0a55e6dec
-
Size
631KB
-
Sample
240319-jlgyyadh46
-
MD5
d5939c8c1bb766426cbde9b0a55e6dec
-
SHA1
9aa4ff8c7107373c1fd74adfe227dd1150545d87
-
SHA256
3cd0e5e72868d42ee787746bbe71a01001779b824daf3346d3cfac2a308d2089
-
SHA512
7d8376c5303f0542136ea6b55455dc60869be12c2cf7017fbc68c263056a73676bf17a58c13662aaf16165f75b845c680f08090f1d45913539a662b31706005d
-
SSDEEP
12288:DLL/HK7zqPVKdVVxDqy5nmLqAeG3q0qAexEYwYBk2eXM+6I8YFZ3zGjot/0Gz:u2dCDRVReq0qHxEYwYbeXn0qlSotcG
Static task
static1
Behavioral task
behavioral1
Sample
d5939c8c1bb766426cbde9b0a55e6dec.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d5939c8c1bb766426cbde9b0a55e6dec.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
lokibot
http://185.227.139.5/sxisodifntose.php/AXMMhuaDYFxHl
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
d5939c8c1bb766426cbde9b0a55e6dec
-
Size
631KB
-
MD5
d5939c8c1bb766426cbde9b0a55e6dec
-
SHA1
9aa4ff8c7107373c1fd74adfe227dd1150545d87
-
SHA256
3cd0e5e72868d42ee787746bbe71a01001779b824daf3346d3cfac2a308d2089
-
SHA512
7d8376c5303f0542136ea6b55455dc60869be12c2cf7017fbc68c263056a73676bf17a58c13662aaf16165f75b845c680f08090f1d45913539a662b31706005d
-
SSDEEP
12288:DLL/HK7zqPVKdVVxDqy5nmLqAeG3q0qAexEYwYBk2eXM+6I8YFZ3zGjot/0Gz:u2dCDRVReq0qHxEYwYbeXn0qlSotcG
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-