General
-
Target
25022025_0039_Orden de compra_(PO201570)_ESUCO SA..iso.zip
-
Size
141KB
-
Sample
250225-azdn1aymz3
-
MD5
35cb30fa75a0ea18a63768741bf21e7d
-
SHA1
7a3aa28e738204bb09e013aba00c4f450d480bab
-
SHA256
bb84a6977ad0d691e64c588d4ea79245a6485ee34365a46935ce931c6454d786
-
SHA512
37250c13433f9e9d6ce6c925434d511aa29180a77a45f87eefc0e4514bf0004fe687571ec2b60e434d55dc50b77ef52eda1ecfc29b42d57c2f9814eab4bdeb81
-
SSDEEP
3072:8dAXpxZXlYAjo0RUFp74L40UNQ3RLMe0xK2ZnI0icvAq6ndKkF:82JXKA00RyM00UGhLH0xTZIf2YV
Static task
static1
Behavioral task
behavioral1
Sample
Orden de compra_(PO201570)_ESUCO SA..exe
Resource
win7-20240903-en
Malware Config
Extracted
lokibot
http://sebel.sbs/Devil/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Orden de compra_(PO201570)_ESUCO SA..exe
-
Size
232KB
-
MD5
aab03994d04827ee44da7459b55e2546
-
SHA1
bbb3773338481ad255fd26adadb129f573f196e3
-
SHA256
141a6b48b260182bfbf3419b85b4d63d06a9bc41dd8ac573528c74c980b01614
-
SHA512
e80e18765b9c4cd08a3a1c6f7900aeab2512fe47860ad20b9dfdfb18e703213c55c624a69bc9a731c38bad7b69882afa34a70ad0ec7df9729955b5144dbb13c4
-
SSDEEP
3072:VC+3I4lYB4iWiLaHQAyti74R4WUNm3RLMU0DK2TnI0qcvAq6nFEAmjc+G:VH3zaXBAiiMaWUAhLb0DTTI52CEAmg+
-
Lokibot family
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-