General
-
Target
e88047f31c1372358c03dae182d70464276357e06f235e3592fdbb66c9e3738d
-
Size
464KB
-
Sample
240417-p9plkshh5w
-
MD5
e17e2f4bae471fbb60c94700bccf9708
-
SHA1
c8b77bddfaeb4a0323c9afb422eef33c04d7fc55
-
SHA256
e88047f31c1372358c03dae182d70464276357e06f235e3592fdbb66c9e3738d
-
SHA512
c276dfabb25447682b99e39f25f0d62a8db39d3d53048aa014941e93b76b222758211a432ff133ea49c76860635f448c5d2882dd0929855f9c9f3037fdccaa2d
-
SSDEEP
12288:+Xvjrimrvfg3hNAMI1EMmMllIDsV0mShtafvgSwr:+fnxr3gRTI1EuD4xbhsHgSK
Static task
static1
Behavioral task
behavioral1
Sample
26094e54ad508b3dcb6e865f95e9d73f921ec0c3b869616fc772a9b7f9218462.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
26094e54ad508b3dcb6e865f95e9d73f921ec0c3b869616fc772a9b7f9218462.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
lokibot
http://sempersim.su/ob/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
26094e54ad508b3dcb6e865f95e9d73f921ec0c3b869616fc772a9b7f9218462.exe
-
Size
488KB
-
MD5
a1995d868283174aa130cf719291bd39
-
SHA1
585c1302132bb9acb7b56a1370a0cc609a6cc380
-
SHA256
26094e54ad508b3dcb6e865f95e9d73f921ec0c3b869616fc772a9b7f9218462
-
SHA512
e44244e93d6dce1059a84563807fa747a3cc23613a9d1e7490fc9a49b682453d27408a26444aa0f5c4ad34ef7c39e5af77facc47e495193ea6d6c471b295dd20
-
SSDEEP
12288:aZcvS2s4WGURNzPhzUQXDbAvScXotUbL:aTBB3RRJAetUbL
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-