General
- Target 0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
- Size 140KB
- Sample240710-bfe86aydpe
- SHA256 0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573
- MD5 caec53ed7ab971ac19643d395f40a95e
- SHA1 8459f1a2a1f3a1e1695eec0fbcb1a4baabdb86ac
- SHA512 1edb8684230a5de9d3e924d8e63f580d219ba39ee3be7a4ff9615c061e35a298e1e7be6983bd152fc68ad8f375da835da9a491023e38ed8fcbec32e7020e583e
- SSDEEP 1536:9rhjRpAPFisr9l5qaKXFRcBPq49+Vfj2vrWZaRF61m2oKs7MBGzQT445j/ULtiSR:JRRpAPZrjrKncB5CoX7ex5jVrDqtd4
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
Resource
win7-20240708-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
Resource
win10v2004-20240709-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://104.248.205.66/index.php/pages?s=1
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target 0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573.exe
- Size 140KB
- SHA256 0f3fcd1903a9b4ac99cdc7ed5e32f591ce28312d8fe8981e7b66a61e92b4a573
- MD5 caec53ed7ab971ac19643d395f40a95e
- SHA1 8459f1a2a1f3a1e1695eec0fbcb1a4baabdb86ac
- SHA512 1edb8684230a5de9d3e924d8e63f580d219ba39ee3be7a4ff9615c061e35a298e1e7be6983bd152fc68ad8f375da835da9a491023e38ed8fcbec32e7020e583e
- SSDEEP 1536:9rhjRpAPFisr9l5qaKXFRcBPq49+Vfj2vrWZaRF61m2oKs7MBGzQT445j/ULtiSR:JRRpAPZrjrKncB5CoX7ex5jVrDqtd4
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext