General
-
Target
3703fd0a78dd7c0c7fd95039b852f630910cdb38edf6eac223c4174603ac89d8.exe
-
Size
726KB
-
Sample
240428-blqxvacf84
-
MD5
d0ddfe864c4befa2fcc6d89f9a7a59be
-
SHA1
d1e13ca84bc0ad0b7f8c167b11b6eeac60d8cd8a
-
SHA256
3703fd0a78dd7c0c7fd95039b852f630910cdb38edf6eac223c4174603ac89d8
-
SHA512
e5b6931de75aff79a3aedf99848222b5667ef7d0aa0e7a497a86d8ac4ed2907d7a2f2d217ffc1c737e79998f41113addc3fe1019125b955452b0f80856b20c8c
-
SSDEEP
12288:38pYTbiUnI+w3363jUfPWL9gokXNuslchJh4l:spY5nILggxcml
Static task
static1
Behavioral task
behavioral1
Sample
3703fd0a78dd7c0c7fd95039b852f630910cdb38edf6eac223c4174603ac89d8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3703fd0a78dd7c0c7fd95039b852f630910cdb38edf6eac223c4174603ac89d8.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
lokibot
http://tampabayllc.top/teamb/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
3703fd0a78dd7c0c7fd95039b852f630910cdb38edf6eac223c4174603ac89d8.exe
-
Size
726KB
-
MD5
d0ddfe864c4befa2fcc6d89f9a7a59be
-
SHA1
d1e13ca84bc0ad0b7f8c167b11b6eeac60d8cd8a
-
SHA256
3703fd0a78dd7c0c7fd95039b852f630910cdb38edf6eac223c4174603ac89d8
-
SHA512
e5b6931de75aff79a3aedf99848222b5667ef7d0aa0e7a497a86d8ac4ed2907d7a2f2d217ffc1c737e79998f41113addc3fe1019125b955452b0f80856b20c8c
-
SSDEEP
12288:38pYTbiUnI+w3363jUfPWL9gokXNuslchJh4l:spY5nILggxcml
Score10/10-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables containing common artifacts observed in infostealers
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-