General
-
Target
041c73bd4c470d02db20ef282a1a8550f8987e362cbd07fc3828c14873a7f772.exe
-
Size
510KB
-
Sample
241121-cg6m6ssmdj
-
MD5
27da3226cd4d9c5d77ff60f9663ea616
-
SHA1
4361864077e17cc22cf9fed5133dbbf655b3f615
-
SHA256
041c73bd4c470d02db20ef282a1a8550f8987e362cbd07fc3828c14873a7f772
-
SHA512
24f877cc2c2b5674de8d1b03f713196ac9dd5c31524785b3f82a8472509050dc67a5ad6d70ccd813fa7bc22ffbf255bfdb7b25fe4cdacae72b8f67f21cf9ddfd
-
SSDEEP
12288:VOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiVjt6URoWqrBbIOQa:Vq5TfcdHj4fmbEoW6BbEa
Behavioral task
behavioral1
Sample
041c73bd4c470d02db20ef282a1a8550f8987e362cbd07fc3828c14873a7f772.exe
Resource
win7-20240903-en
Malware Config
Extracted
lokibot
http://87.120.113.235/18/pin.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
041c73bd4c470d02db20ef282a1a8550f8987e362cbd07fc3828c14873a7f772.exe
-
Size
510KB
-
MD5
27da3226cd4d9c5d77ff60f9663ea616
-
SHA1
4361864077e17cc22cf9fed5133dbbf655b3f615
-
SHA256
041c73bd4c470d02db20ef282a1a8550f8987e362cbd07fc3828c14873a7f772
-
SHA512
24f877cc2c2b5674de8d1b03f713196ac9dd5c31524785b3f82a8472509050dc67a5ad6d70ccd813fa7bc22ffbf255bfdb7b25fe4cdacae72b8f67f21cf9ddfd
-
SSDEEP
12288:VOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiVjt6URoWqrBbIOQa:Vq5TfcdHj4fmbEoW6BbEa
-
Lokibot family
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-