General
-
Target
Remittance_CT022024.exe
-
Size
938KB
-
Sample
250220-sm2jeayqz6
-
MD5
6ba300b78a4f898b931cb4889ce9c461
-
SHA1
198207a44362b3e7cd1065973c0047619753ac99
-
SHA256
0db0c831bf2a05700a58dbef8e3ef35af21b6a6dd4de42fa68dfbc608aaf2d5a
-
SHA512
946a890c7bd74ca4e70f9e51fafd2308ce722d33516c0b1350d8edcbabda66e00e2a9f44175578f570df94531945e8041e95c5e8338ef2a5fcd9397eb56b2581
-
SSDEEP
24576:Hu6J33O0c+JY5UZ+XC0kGso6Fa6jdol/kIX6lYtWY:Bu0c++OCvkGs9Fa6jdg/kntY
Static task
static1
Behavioral task
behavioral1
Sample
Remittance_CT022024.exe
Resource
win7-20241010-en
Malware Config
Extracted
lokibot
http://touxzw.ir/fix/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Remittance_CT022024.exe
-
Size
938KB
-
MD5
6ba300b78a4f898b931cb4889ce9c461
-
SHA1
198207a44362b3e7cd1065973c0047619753ac99
-
SHA256
0db0c831bf2a05700a58dbef8e3ef35af21b6a6dd4de42fa68dfbc608aaf2d5a
-
SHA512
946a890c7bd74ca4e70f9e51fafd2308ce722d33516c0b1350d8edcbabda66e00e2a9f44175578f570df94531945e8041e95c5e8338ef2a5fcd9397eb56b2581
-
SSDEEP
24576:Hu6J33O0c+JY5UZ+XC0kGso6Fa6jdol/kIX6lYtWY:Bu0c++OCvkGs9Fa6jdg/kntY
-
Lokibot family
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-