General
-
Target
857fd5543f14e01ea3b08d3aca6ee6763042a48d7b04c9f035a4a37a4d2e0039.exe
-
Size
689KB
-
Sample
240427-bwsjesgb77
-
MD5
8bdfe306f813ba1a65ecf6e1da4085c1
-
SHA1
7bca83400323c71ee5bd1d655004a4a762e1c71b
-
SHA256
857fd5543f14e01ea3b08d3aca6ee6763042a48d7b04c9f035a4a37a4d2e0039
-
SHA512
d8d8f885f172cac4f47ffeb934f4b2ba076aedbe86851d96e7e410ba18b3ecaa1b9448e87f699de4069909ba5debb34ecd3065465e4aaf2a22106050eccf253d
-
SSDEEP
12288:4YqnHvjNIrpf9rN/mc/C/7rFps1mv2XlOZPAgK711pwLKnJLqzLYskR:41PjKr5BNDQ7rF6BOZYgK7OYJLkLS
Static task
static1
Behavioral task
behavioral1
Sample
857fd5543f14e01ea3b08d3aca6ee6763042a48d7b04c9f035a4a37a4d2e0039.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
857fd5543f14e01ea3b08d3aca6ee6763042a48d7b04c9f035a4a37a4d2e0039.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
lokibot
http://45.77.223.48/~blog/?ajax=posts.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
857fd5543f14e01ea3b08d3aca6ee6763042a48d7b04c9f035a4a37a4d2e0039.exe
-
Size
689KB
-
MD5
8bdfe306f813ba1a65ecf6e1da4085c1
-
SHA1
7bca83400323c71ee5bd1d655004a4a762e1c71b
-
SHA256
857fd5543f14e01ea3b08d3aca6ee6763042a48d7b04c9f035a4a37a4d2e0039
-
SHA512
d8d8f885f172cac4f47ffeb934f4b2ba076aedbe86851d96e7e410ba18b3ecaa1b9448e87f699de4069909ba5debb34ecd3065465e4aaf2a22106050eccf253d
-
SSDEEP
12288:4YqnHvjNIrpf9rN/mc/C/7rFps1mv2XlOZPAgK711pwLKnJLqzLYskR:41PjKr5BNDQ7rF6BOZYgK7OYJLkLS
Score10/10-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables containing common artifacts observed in infostealers
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-