General
-
Target
heathzx.scr.exe
-
Size
475KB
-
Sample
240513-qb3afsfg31
-
MD5
ef7dcebf0a73f49ded7f17ba4b3c1597
-
SHA1
e2f6a9664fe8b53e82932491a963f3b3a15dc8a1
-
SHA256
120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a
-
SHA512
79dd1d828effff5953d497405b009da0298215975aa2790eb9c9d2d519f9ff34cdb8b9f4634be82fd107b9b9bd9bce299334deba2e338cb0f2d78b9c044fcc23
-
SSDEEP
6144:8ApnvFMLzuP4RAu1icAp9/7ZxWgwxahXL92z2D8eYqzwcbL+6MyryXpZ+UnS1GKf:8kxwwJxWdahRg2ZHq6Myry1WQwLX
Static task
static1
Behavioral task
behavioral1
Sample
heathzx.scr.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
heathzx.scr.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
lokibot
http://spencerstuartllc.top/evie2/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
heathzx.scr.exe
-
Size
475KB
-
MD5
ef7dcebf0a73f49ded7f17ba4b3c1597
-
SHA1
e2f6a9664fe8b53e82932491a963f3b3a15dc8a1
-
SHA256
120cacb24dddf38d691c51a2f8fcce313574c5edbe35d00bae9d654968d7389a
-
SHA512
79dd1d828effff5953d497405b009da0298215975aa2790eb9c9d2d519f9ff34cdb8b9f4634be82fd107b9b9bd9bce299334deba2e338cb0f2d78b9c044fcc23
-
SSDEEP
6144:8ApnvFMLzuP4RAu1icAp9/7ZxWgwxahXL92z2D8eYqzwcbL+6MyryXpZ+UnS1GKf:8kxwwJxWdahRg2ZHq6Myry1WQwLX
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-