General
-
Target
3bd1d5e02fc4bd9bd646e239d0359644255747b3830ff02386dd6136ed2b54d3
-
Size
290KB
-
Sample
240511-kr93caaa3x
-
MD5
4dea720c52b5c90571677f2173d3198f
-
SHA1
b8a9828016ea9950686de7e982bb29e363bf2550
-
SHA256
3bd1d5e02fc4bd9bd646e239d0359644255747b3830ff02386dd6136ed2b54d3
-
SHA512
2b26689a5dda2ec6df89bba62722da727a40c2e12a82155281a2486c62ced1b2f278453cff83129414693371c60b3c07554aa529878392467879284880a0369d
-
SSDEEP
6144:EfPHB0D6lHdRSfDf36EhscO4RnZTTSdKJF90IuHBCYGBpge/rry8:EHh8gRYjsARZ/SyUIuMLX
Static task
static1
Behavioral task
behavioral1
Sample
3d83a42c7406a8805e6293230a4fcdfabbf740dcb2d5a1bbea4015e6893450bb.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3d83a42c7406a8805e6293230a4fcdfabbf740dcb2d5a1bbea4015e6893450bb.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
lokibot
http://meridianresourcellc.top/document/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
3d83a42c7406a8805e6293230a4fcdfabbf740dcb2d5a1bbea4015e6893450bb.exe
-
Size
332KB
-
MD5
89f7e752cb6dbeb5fdfe82a67df3a9bc
-
SHA1
249a25d0f254b074f8fcba656512a8f4a6101552
-
SHA256
3d83a42c7406a8805e6293230a4fcdfabbf740dcb2d5a1bbea4015e6893450bb
-
SHA512
f9da3e83577828e85930b1551022adb4f3dec5e51e22d84602cd542e59456ea3e98b317ac137b9d010f4fe8b9aef60fd13b592265ebd7a6e298db6145411eacb
-
SSDEEP
6144:x38aRUwl6wrlMawpfDkCLNObM/hGBYWv3XZIxUY812jk7NguDRO:xH+wjRaNObM/svXe/8CvAs
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-