General
-
Target
26022025_0101_25022025_PRI_VTK250419A.gz
-
Size
527KB
-
Sample
250226-bdejvaykw4
-
MD5
79fc5f19f02193f1c7b77c6868a8f3a7
-
SHA1
b06fddd12ac4b5a534a37c4e491437c2031b1f93
-
SHA256
766382ef1f17cea45a998a0782c5084d97d555490aa99f640b6f1916623752ce
-
SHA512
9c50ca0b88798ad40971c7fe2d233111d44565cc482bd7283a343384b33808e5c8d3bf10112e1e142c4766ebf92ea25f51e5d7564df51b72ae1ca9ff0fc86ffd
-
SSDEEP
12288:0+J1quiD2ojKOEob232eeUwyY+EieLnzgxQqOrnB22azZL+yy8:0+Tojfw2H+EjnzYg4ny8
Static task
static1
Behavioral task
behavioral1
Sample
PRI_VTK250419A.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
PRI_VTK250419A.exe
Resource
win10v2004-20250217-en
Malware Config
Extracted
lokibot
http://touxzw.ir/scc1/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
PRI_VTK250419A.exe
-
Size
944KB
-
MD5
d45ab46d87bb599ccc62569c10d2d323
-
SHA1
d7010744a6dc830a79406b04ce281c7b60cc531a
-
SHA256
f29f7c7516de91fc3d8e1d6c23590cc5c73a9123176cd6b742c8d5c23d5da9f5
-
SHA512
7abb34238334e294e8d13e1bc90db54fafa1b151738da434412625e8808dfe633449c780a98112b70b2520c572d5aa5e8501507f24fbb2ffdc02f92b0c8cb5bf
-
SSDEEP
24576:Du6J33O0c+JY5UZ+XC0kGso6Fam9GwLqWY:Nu0c++OCvkGs9Fam9Gw1Y
-
Lokibot family
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-