General
-
Target
MalwareBazaar.11
-
Size
317KB
-
Sample
240806-h3rzssxaka
-
MD5
8625ee224eabe551094b1608e9919d6e
-
SHA1
8eb8ef4b3a9e590588115613b7296355290daf6f
-
SHA256
7dba6063a64ca29963a57881589dbb513c94a77766d98e67bd6bab790e07209a
-
SHA512
04dac907db97080a42ce27ef416c40ca72a3450653aaffa65f292096215c61d2eeabdc4566d1011584fb4625b699b1edb7675fd1f3c19c9ec3cfb0f898f7e972
-
SSDEEP
3072:bZCQr5nK4Uid534hUSZ/vJzZ8nzCF+qosNI27BV3yvNRNK5BddNvHTt:NFnbt3420/vJ98zg/BVCv4tdVT
Static task
static1
Behavioral task
behavioral1
Sample
MalwareBazaar.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
MalwareBazaar.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
lokibot
http://werdotx.shop/DOT/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
MalwareBazaar.11
-
Size
317KB
-
MD5
8625ee224eabe551094b1608e9919d6e
-
SHA1
8eb8ef4b3a9e590588115613b7296355290daf6f
-
SHA256
7dba6063a64ca29963a57881589dbb513c94a77766d98e67bd6bab790e07209a
-
SHA512
04dac907db97080a42ce27ef416c40ca72a3450653aaffa65f292096215c61d2eeabdc4566d1011584fb4625b699b1edb7675fd1f3c19c9ec3cfb0f898f7e972
-
SSDEEP
3072:bZCQr5nK4Uid534hUSZ/vJzZ8nzCF+qosNI27BV3yvNRNK5BddNvHTt:NFnbt3420/vJ98zg/BVCv4tdVT
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-