General
- Target jaffacakes118_Trojan-Spy.Win32.Zbot.zscv.21ddda0468527bcdba961787f7cfae6e
- Size 994KB
- Sample261016-dmay5agw2p
- SHA256 bf3e3d4ffd813baab964bcb8777f5cbb74e554f0de85e846898ed969be795963
- MD5 21ddda0468527bcdba961787f7cfae6e
- SHA1 18b3f6194210a2dfeeeb55d3be987328a8506e0e
- SHA512 b2c780bf921467d05e8063e4ceaf733a6fe6ea1286bd1791da447bacb0e77f4387d31b8ca40d36d7c45edeb9c99795f72f448eb4f2195c9fb5f892d23659bf6c
- SSDEEP 24576:y4lavt0LkLL9IMixoEgeaBf6dNqy6Mq9MmCS:lkwkn9IMHeaBf6dLaPCS
- TLSH T15925AE0373DD83A5C3725273BA65BB01AEBB7C2506A1F59B2FD4093DF920162921E673
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Spy.Win32.Zbot.zscv.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
lokibot
C2
-
http://outlooks.duckdns.org:8900/admin/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Targets
-
- Target jaffacakes118_Trojan-Spy.Win32.Zbot.zscv.21ddda0468527bcdba961787f7cfae6e
- Size 994KB
- SHA256 bf3e3d4ffd813baab964bcb8777f5cbb74e554f0de85e846898ed969be795963
- MD5 21ddda0468527bcdba961787f7cfae6e
- SHA1 18b3f6194210a2dfeeeb55d3be987328a8506e0e
- SHA512 b2c780bf921467d05e8063e4ceaf733a6fe6ea1286bd1791da447bacb0e77f4387d31b8ca40d36d7c45edeb9c99795f72f448eb4f2195c9fb5f892d23659bf6c
- SSDEEP 24576:y4lavt0LkLL9IMixoEgeaBf6dNqy6Mq9MmCS:lkwkn9IMHeaBf6dLaPCS
- TLSH T15925AE0373DD83A5C3725273BA65BB01AEBB7C2506A1F59B2FD4093DF920162921E673
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext