General
-
Target
cb311433fa1c8d6e80cbb8e13bc1af80c1a5c6ffbc10d28096671b5188f8b835
-
Size
104KB
-
Sample
240825-f8r6msxcle
-
MD5
46e14dc04ccfe824f67fa6eb57edd38a
-
SHA1
74481772cc6c62a20a1ea2ddc7d8b2ff6eeae9b5
-
SHA256
cb311433fa1c8d6e80cbb8e13bc1af80c1a5c6ffbc10d28096671b5188f8b835
-
SHA512
49f07edbf81a9bf6248a9eadc7110256cd60784f220664cfb634f4ef79d609de2d390b10dd48e678f31193fa3618c8b5fb875f083a0c95028559b40e15a2b9a2
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Behavioral task
behavioral1
Sample
cb311433fa1c8d6e80cbb8e13bc1af80c1a5c6ffbc10d28096671b5188f8b835.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
cb311433fa1c8d6e80cbb8e13bc1af80c1a5c6ffbc10d28096671b5188f8b835.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
lokibot
http://91.243.80.67/ddx/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
cb311433fa1c8d6e80cbb8e13bc1af80c1a5c6ffbc10d28096671b5188f8b835
-
Size
104KB
-
MD5
46e14dc04ccfe824f67fa6eb57edd38a
-
SHA1
74481772cc6c62a20a1ea2ddc7d8b2ff6eeae9b5
-
SHA256
cb311433fa1c8d6e80cbb8e13bc1af80c1a5c6ffbc10d28096671b5188f8b835
-
SHA512
49f07edbf81a9bf6248a9eadc7110256cd60784f220664cfb634f4ef79d609de2d390b10dd48e678f31193fa3618c8b5fb875f083a0c95028559b40e15a2b9a2
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-