Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
438a415e93bdec6a0966e110555d61b66da066123b3828b2b4f6f64c74b1b158.exe
-
Size
949KB
-
Sample
250204-2ly7bsxpcr
-
MD5
77d35df79aaa0093206730231fc545ce
-
SHA1
ba6a0245580e5725b662e12a03a4b48639b6eba5
-
SHA256
438a415e93bdec6a0966e110555d61b66da066123b3828b2b4f6f64c74b1b158
-
SHA512
fcd9c41440cb097d18e6f7ed62afaf7d47a4ae5f570748ac0c2b6214f333cf2e72221e18533e5fbf73293d3461261e4c85b2d8cf6f2ca8124f6ebc19ac56a0df
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXFmIa9X5usZKtl5+:Vh+ZkldoPK1Xa9X8sZA+
Static task
static1
Behavioral task
behavioral1
Sample
438a415e93bdec6a0966e110555d61b66da066123b3828b2b4f6f64c74b1b158.exe
Resource
win7-20240903-en
Malware Config
Extracted
lokibot
http://royalsailtravel.ru/Sacc/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
438a415e93bdec6a0966e110555d61b66da066123b3828b2b4f6f64c74b1b158.exe
-
Size
949KB
-
MD5
77d35df79aaa0093206730231fc545ce
-
SHA1
ba6a0245580e5725b662e12a03a4b48639b6eba5
-
SHA256
438a415e93bdec6a0966e110555d61b66da066123b3828b2b4f6f64c74b1b158
-
SHA512
fcd9c41440cb097d18e6f7ed62afaf7d47a4ae5f570748ac0c2b6214f333cf2e72221e18533e5fbf73293d3461261e4c85b2d8cf6f2ca8124f6ebc19ac56a0df
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXFmIa9X5usZKtl5+:Vh+ZkldoPK1Xa9X8sZA+
-
Lokibot family
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-