General
-
Target
22aca70ae3bb6c5b86ecdb830baeb4f369d2a9e67baa2f915c81c6bea5d3250d.exe
-
Size
104KB
-
Sample
240824-bfjataxdkg
-
MD5
201f4fa1f315972e323d4b502850b94d
-
SHA1
c063a403c0698955f431eb56afb40864a692920f
-
SHA256
22aca70ae3bb6c5b86ecdb830baeb4f369d2a9e67baa2f915c81c6bea5d3250d
-
SHA512
69067d60e0bf227e4a1899986367856e4196c5efcb066dd537fa33c1f5c45280d0096c74b95c5d080c24a0b9cee3508cb101e2e3c487b5aa26062bfbbed3107d
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Behavioral task
behavioral1
Sample
22aca70ae3bb6c5b86ecdb830baeb4f369d2a9e67baa2f915c81c6bea5d3250d.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
22aca70ae3bb6c5b86ecdb830baeb4f369d2a9e67baa2f915c81c6bea5d3250d.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
lokibot
http://104.248.205.66/index.php/posts.php?8=1
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
22aca70ae3bb6c5b86ecdb830baeb4f369d2a9e67baa2f915c81c6bea5d3250d.exe
-
Size
104KB
-
MD5
201f4fa1f315972e323d4b502850b94d
-
SHA1
c063a403c0698955f431eb56afb40864a692920f
-
SHA256
22aca70ae3bb6c5b86ecdb830baeb4f369d2a9e67baa2f915c81c6bea5d3250d
-
SHA512
69067d60e0bf227e4a1899986367856e4196c5efcb066dd537fa33c1f5c45280d0096c74b95c5d080c24a0b9cee3508cb101e2e3c487b5aa26062bfbbed3107d
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-