General
-
Target
eyIFanijo.exe
-
Size
147KB
-
Sample
240709-fsyngsxemn
-
MD5
a06d563641bb76a56d398568ea0e9795
-
SHA1
dc81eb51de4d8ffbf0bbbcbdb3f3c6980d09e416
-
SHA256
e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54
-
SHA512
a1beb17ff9486409f5a1f38b63e57a5ea3e5a66fca45e832b8671c738378379d5a459a883bde9f1bd98346350e39c3a22971f373e02defa4e822e4d12d6d0913
-
SSDEEP
3072:n808ghSE5bkWp6aKeGn+Yembgy04MT97:8MhD5bTuevydW
Static task
static1
Behavioral task
behavioral1
Sample
eyIFanijo.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
eyIFanijo.exe
Resource
win10v2004-20240704-en
Malware Config
Extracted
lokibot
http://104.248.205.66/index.php/pages?s=1
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
eyIFanijo.exe
-
Size
147KB
-
MD5
a06d563641bb76a56d398568ea0e9795
-
SHA1
dc81eb51de4d8ffbf0bbbcbdb3f3c6980d09e416
-
SHA256
e4c4990451cfa8c8a75a65d68c8dc7efde67ba3cdca812636895f8488005da54
-
SHA512
a1beb17ff9486409f5a1f38b63e57a5ea3e5a66fca45e832b8671c738378379d5a459a883bde9f1bd98346350e39c3a22971f373e02defa4e822e4d12d6d0913
-
SSDEEP
3072:n808ghSE5bkWp6aKeGn+Yembgy04MT97:8MhD5bTuevydW
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-