General
-
Target
8331118cac957fd6de499161580db764.bin
-
Size
524KB
-
Sample
240516-dbrgqsha9x
-
MD5
6947ace887e03ecfb5191772119fff51
-
SHA1
9f9dd76ba99dff21c113f57141a7b373d3f196d6
-
SHA256
7bd85d03d6e48e43b9ad40144f4bd090bafc5f5d444496f4c00a219417334dbd
-
SHA512
63abaf7b8bcaca87e8324dd0be030ba7ed080727c1f4723bedd7981880c2ebce5be5a3a3465b0c588330624d39a5243d0eb0161a370c7b424736e3429b15f135
-
SSDEEP
12288:/stOu6S2CZLy3/rQGO/0ZbPdrLMpLfItJLBl9ZhcEkStAqrLc1O:/I66ArQGOOMpjGj9Z2ENtAqaO
Static task
static1
Behavioral task
behavioral1
Sample
a1dd7d24763249bcbf451a5c7e58b950e04f365757b627b57546ad80ac00c028.exe
Resource
win7-20240221-en
Malware Config
Extracted
lokibot
http://sempersim.su/d2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
a1dd7d24763249bcbf451a5c7e58b950e04f365757b627b57546ad80ac00c028.exe
-
Size
554KB
-
MD5
8331118cac957fd6de499161580db764
-
SHA1
944d3f2ed04a7213c5d6774932784e70fa268c26
-
SHA256
a1dd7d24763249bcbf451a5c7e58b950e04f365757b627b57546ad80ac00c028
-
SHA512
98d5e0e21a96a1eea2217fd60a997570444df51846776debf36eaa336b0bedb637544b43ced0b1b64f0b17a9eb51aa305be8a4609f2cae3d71e0355669d7ed3f
-
SSDEEP
12288:05sAXYMjhvPie/rByY7777777777777eEQiRU0pxkoabc+VC1Y6ae2Rg:05sAXYMFniyys207PIc4CK60
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-