General
-
Target
4fe39a6ca43136c5f3a422bccdf0648ddb6254364a41600e5157270e8f62dbf8
-
Size
499KB
-
Sample
240417-rq31zabg48
-
MD5
13da592c0f39e1bd162992c91fdb5e3c
-
SHA1
b751f7776ec4b9c06bc6b03dcbd56555286d9c79
-
SHA256
4fe39a6ca43136c5f3a422bccdf0648ddb6254364a41600e5157270e8f62dbf8
-
SHA512
88ccf57ad5005a2fc43d9303c6bff98241ac6fe2989e259c9f423e2fa471571129f339a37ff938cc25aac9bf831060b139552b85c630bb1c7d162d5926242ca9
-
SSDEEP
12288:EIifpm9z8DDqaDn34JdTRrudeOpFMWZ8D1oaeAz9bGKk:jiw3TstZ8B/pzcb
Static task
static1
Behavioral task
behavioral1
Sample
475605b7bec0b5c75c6e2592fd3484c2355c7d20070efdf29bb3091270f3e512.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
475605b7bec0b5c75c6e2592fd3484c2355c7d20070efdf29bb3091270f3e512.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
lokibot
http://ebnsina.top/kelvin/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
475605b7bec0b5c75c6e2592fd3484c2355c7d20070efdf29bb3091270f3e512.exe
-
Size
927KB
-
MD5
9d75b956b1aaaa9f0bbb13cb760f7494
-
SHA1
612f4c7d0d30d1c9250a5bfaaade25f950f5012e
-
SHA256
475605b7bec0b5c75c6e2592fd3484c2355c7d20070efdf29bb3091270f3e512
-
SHA512
46d59a1daeabc0942ab1365d772e95d28a09e6d71fd42e76daf5073f125e633b0764a5ec328c6591e2ded4d8bdcc2c806fc3fb3707d34b33f7cb25e7f0fc20ff
-
SSDEEP
12288:ghkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a1yUz4qVqcVWYh/e+Wf:oRmJkcoQricOIQxiZY1ia17cqV1teZ
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-