General
-
Target
24899e0590707e01cd9fbdfab6dd922b.bin
-
Size
328KB
-
Sample
240422-bhe16sdd42
-
MD5
2941c61c39b1ff48fe7d66a04303efce
-
SHA1
77d188022789f30e5c97e53fa2246c6a5e66314d
-
SHA256
287e42dc9fd8e526c5a033a8b64176ea3e2368f1fd1b9697563590ea72d7764d
-
SHA512
ad697b52d9904bb6e8fa26707acc5239c091d2362d23bb80a1ba9237b51616e54870eea531400e47717385846f83683fd01f6809bed6b16b4a1af8229f27f272
-
SSDEEP
6144:QMBypB4zi/wpF912Pq3Fn7wV06xhffpKGIuJLy+XXQ6oNHUFrrlCxJ4:QMsyi/wXXdn6HxKGIuFykXJoN0FrxCf4
Static task
static1
Behavioral task
behavioral1
Sample
054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
lokibot
http://94.156.65.182/tomthf/cvghx/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952.exe
-
Size
359KB
-
MD5
24899e0590707e01cd9fbdfab6dd922b
-
SHA1
ae88a813c9dd1d766134789052f1e8e1ecaeb4be
-
SHA256
054527988476fbdfcca3d4eec4d530c5529e2360b3f84beab0578b1411cad952
-
SHA512
1c514b5cccd7610260a52f8810c8bfe67c9c7d18d31a7fd1d85a1bb3ace5ff9e2212599653f323cf022a8c0d1f5a28bc8f32b59c87c4c9428fe7e852109c9f44
-
SSDEEP
6144:XUYNazqRCG5W3N95g8xzxr2RFx7+/3qrjTepYSUtKAhJMmo+g1R5E/meXvgDSgi8:EdzmloBxzxr2Rv7+CrHD5tlJyDnK/mek
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-