General
-
Target
0a82abc8a3463c2ba89a6100e544e7b679b4c429732029f4e035bead0184b7ba
-
Size
130KB
-
Sample
241202-nv6e4ssnaz
-
MD5
a82c5bc7b3250c6b7d6e6bd6254f8636
-
SHA1
0cd73b80d6645ce74dccc4bdb6e81523bbf72552
-
SHA256
0a82abc8a3463c2ba89a6100e544e7b679b4c429732029f4e035bead0184b7ba
-
SHA512
f29117ef59f940c2c70606596f328d0310aed95d95e5b96e28d9061e92e05942d143d0130e45f789f3905871c8214b54d0708d01adebc9432e15d08b9c49f47e
-
SSDEEP
3072:fwoXXec7JBhm/GMEPLr+aT71m1hN5P4/3ms3QEN+GNszoAMdjhTlN4lzjDZaQ:ff+cdBhtVr++kvxHEsGvAMR/N4NDB
Static task
static1
Behavioral task
behavioral1
Sample
Pirkuma pasūtījums_(PO40232)_LEAX Baltix SIA.exe
Resource
win7-20241010-en
Malware Config
Extracted
lokibot
https://ddrtot.shop/MV3/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Pirkuma pasūtījums_(PO40232)_LEAX Baltix SIA.exe
-
Size
225KB
-
MD5
9a5eb541f9df732ca5158c96cded4ae6
-
SHA1
9dc7a4e784e7c9cad8eecaaba56bf43e14d30599
-
SHA256
75173e92fd7a13e7be3ec177c5287280aae4d2a5e6911cd1458400d96289d18d
-
SHA512
a1e71885ce4e9b05b4075bc8164151109f19b7a6f15cacc09d7c25159f079e584ef525dfd31ea431cc0cb8a93f8950e2614771f769f90769ef55e5f70eceb52f
-
SSDEEP
3072:k9iIXdVtoSgo/GMEzLr+aTN1m1hN5P4h3ms3QEN+GNstgAMdjFTlN4l5jrVlWdL6:etWSg/Vr++ivxTEsGhAMRzN4nx
-
Lokibot family
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-