General
-
Target
0415cad6fdc37b6ef123d454f71afbb74f7d1a4865498606f3f6b7d12b1eb100.exe
-
Size
489KB
-
Sample
240323-cffqcsef6w
-
MD5
133d3287fd13f069c75be6141adfb917
-
SHA1
67db917071345b20f13d9b7c06a739688ad5a871
-
SHA256
0415cad6fdc37b6ef123d454f71afbb74f7d1a4865498606f3f6b7d12b1eb100
-
SHA512
773b10fbc087fe2380f646447286059c06fa54bb17b2cb62f862f93bb27e190e81c2238f8bb45ab09374072436da2c24968faecb7b21fd105b0660192cd425ff
-
SSDEEP
12288:zbs3/5X6MAch7DxSCJt9K1uBX16U+qK2ui9aZy/:fwBp5VzdbBEpqKpi9aZ
Static task
static1
Behavioral task
behavioral1
Sample
0415cad6fdc37b6ef123d454f71afbb74f7d1a4865498606f3f6b7d12b1eb100.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0415cad6fdc37b6ef123d454f71afbb74f7d1a4865498606f3f6b7d12b1eb100.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
lokibot
https://sempersim.su/c18/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
0415cad6fdc37b6ef123d454f71afbb74f7d1a4865498606f3f6b7d12b1eb100.exe
-
Size
489KB
-
MD5
133d3287fd13f069c75be6141adfb917
-
SHA1
67db917071345b20f13d9b7c06a739688ad5a871
-
SHA256
0415cad6fdc37b6ef123d454f71afbb74f7d1a4865498606f3f6b7d12b1eb100
-
SHA512
773b10fbc087fe2380f646447286059c06fa54bb17b2cb62f862f93bb27e190e81c2238f8bb45ab09374072436da2c24968faecb7b21fd105b0660192cd425ff
-
SSDEEP
12288:zbs3/5X6MAch7DxSCJt9K1uBX16U+qK2ui9aZy/:fwBp5VzdbBEpqKpi9aZ
Score10/10-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables containing common artifacts observed in infostealers
-
Detects executables packed with SmartAssembly
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-