General
-
Target
0a7d090ef4b4e464f985b45472988699_JaffaCakes118
-
Size
372KB
-
Sample
240430-1n8ywaac68
-
MD5
0a7d090ef4b4e464f985b45472988699
-
SHA1
b9d445a7263e802f8cbf9cdd7a7e01fc74846429
-
SHA256
6cb0c34cb82139a20ef69574a7013b03229f551c7e80313843bd3d59991f12f2
-
SHA512
904d014d3a7e752015fc434bad6dbb07a4f0c98c368d621854d09f497f1326e88f12a4ce8fd805f8cac63de6ca68886a49ee129067a5f91b504be9f3f71fb3dc
-
SSDEEP
6144:01CvhfOWl1AfXfmy8MD8xjIosBOCl9U2YtZCE+8txetx5ahsIy0uGOJ/ICwz6vNs:Citl1evmydDoABOKU2YDCE+8G/sLy1Gz
Static task
static1
Behavioral task
behavioral1
Sample
772_666_pdf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
772_666_pdf.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
lokibot
http://ducatl.com/coco/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
772_666_pdf.exe
-
Size
635KB
-
MD5
af8c4d839b47c2fcdbc3109e2ca170f3
-
SHA1
1414161308761edee92301a90585a6219f83f480
-
SHA256
ffc8920265a326a746708c21222c3546242b468d202b2be2f4f9e99462fec235
-
SHA512
62f4da61e33576b37327b87698f19504b90fffaba9a72fd0406bff5909c218e9b26c170e4520d02aafc884f0c34360187c3975e8a59c3c2762772b88291048b6
-
SSDEEP
12288:JKzVIr2VadKEcOhKj/EZhhxqhe4g1euWUrIbho5NPBo:2mJdKKKjmhyVg1euXrINUo
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-