General
-
Target
de4864fb07cf56acc544dc56462c2243
-
Size
374KB
-
Sample
240325-scjwlsbc37
-
MD5
de4864fb07cf56acc544dc56462c2243
-
SHA1
520a11afb0bf7fc8eafa454d30c20984035b9d3d
-
SHA256
f4a13349af9fadfa63e888b2d7e03151aac194eb9190edfe0aedd272273f8b56
-
SHA512
d16c3a9a326112b5aaa06ed3f99c751b8c0fd8766512428158cfb584b25e31ccb64705bddc692b1c864a5d6e8edbc183443bdeb299e4a62ec44d104cb65b1068
-
SSDEEP
6144:WfHH8dFhreJSGghPZuZ7kyxP6sf68/bed/16CzjMqH2oezAHntaHiJs0hEIaH1Y:WPHAmQmZ7MsS8/id/16AM824iI81
Static task
static1
Behavioral task
behavioral1
Sample
de4864fb07cf56acc544dc56462c2243.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
de4864fb07cf56acc544dc56462c2243.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
lokibot
https://www.rnofinancial.com.au/wp03/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
de4864fb07cf56acc544dc56462c2243
-
Size
374KB
-
MD5
de4864fb07cf56acc544dc56462c2243
-
SHA1
520a11afb0bf7fc8eafa454d30c20984035b9d3d
-
SHA256
f4a13349af9fadfa63e888b2d7e03151aac194eb9190edfe0aedd272273f8b56
-
SHA512
d16c3a9a326112b5aaa06ed3f99c751b8c0fd8766512428158cfb584b25e31ccb64705bddc692b1c864a5d6e8edbc183443bdeb299e4a62ec44d104cb65b1068
-
SSDEEP
6144:WfHH8dFhreJSGghPZuZ7kyxP6sf68/bed/16CzjMqH2oezAHntaHiJs0hEIaH1Y:WPHAmQmZ7MsS8/id/16AM824iI81
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-