Overview

overview

10

Static

static

3

668b417665...3a.exe

windows11-ltsc_2024-x64

10

Resubmissions

04/08/2026, 06:15

260804-gzzd2ahj7t10

04/08/2026, 06:12

260804-gx614asfmb10

21/07/2026, 19:38

260721-yctnpshj9y10

Sharing

Copy URL Twitter E-mail

General

  • Target
    668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a.exe
  • Size 1.2MB
  • Sample260804-gx614asfmb
  • SHA256 668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
agentteslalokibotcollectiondiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

  • agenttesla

C2

  • https://api.telegram.org/bot6670375909:AAF4GVzfhy3KyMMlBfsyRBAGBlEBJIbvDgs/

Extracted

Family

  • lokibot

C2

  • http://montblancgroup.cfd/New/PWS/fre.php

  • http://kbfvzoboss.bid/alien/fre.php

  • http://alphastand.trade/alien/fre.php

  • http://alphastand.win/alien/fre.php

  • http://alphastand.top/alien/fre.php

Targets

    • Target
      668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a.exe
    • Size 1.2MB
    • SHA256 668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectiondiscoveryagentteslalokibotkeyloggerspywarestealertrojan

    • Family: AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Family: Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Executes dropped EXE

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • ConfuserEx .NET packer

      Detects ConfuserEx .NET packer.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks