General
-
Target
7cfbe6d3f41c153c78f4e24211ffd891cde46411f072d83798e0e03e140a7021.exe
-
Size
183KB
-
Sample
241205-tzremssmcy
-
MD5
d1d899b06642500d72acaeb42896b348
-
SHA1
69683cca8c559a7cc2b6484ea982b2ca44be7a2f
-
SHA256
7cfbe6d3f41c153c78f4e24211ffd891cde46411f072d83798e0e03e140a7021
-
SHA512
69a69e0546a0972135b34561f530765046649296be879f83606d613a00c5a1b5f48b4bb91df1f91854dba3d80e4ce5c82fe03670ea0c1c4cbef0856c030312e5
-
SSDEEP
3072:Dj2RbI+4N6qZjddV5stDIoMNLGcJEma5cPGWUIi3gCmPc/NNsOsajV5f8ve:D+mZ5z2DeJEmaW1C9+cTsXwV5G
Static task
static1
Behavioral task
behavioral1
Sample
7cfbe6d3f41c153c78f4e24211ffd891cde46411f072d83798e0e03e140a7021.exe
Resource
win7-20241023-en
Malware Config
Extracted
lokibot
https://dddotx.shop/Mine/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
7cfbe6d3f41c153c78f4e24211ffd891cde46411f072d83798e0e03e140a7021.exe
-
Size
183KB
-
MD5
d1d899b06642500d72acaeb42896b348
-
SHA1
69683cca8c559a7cc2b6484ea982b2ca44be7a2f
-
SHA256
7cfbe6d3f41c153c78f4e24211ffd891cde46411f072d83798e0e03e140a7021
-
SHA512
69a69e0546a0972135b34561f530765046649296be879f83606d613a00c5a1b5f48b4bb91df1f91854dba3d80e4ce5c82fe03670ea0c1c4cbef0856c030312e5
-
SSDEEP
3072:Dj2RbI+4N6qZjddV5stDIoMNLGcJEma5cPGWUIi3gCmPc/NNsOsajV5f8ve:D+mZ5z2DeJEmaW1C9+cTsXwV5G
-
Lokibot family
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-