General
-
Target
SOR Price 062820KATARA PROJECT - MECH SOR (Tender).exe
-
Size
598KB
-
Sample
200630-39zgk69xee
-
MD5
ee1301ef174dab2858125132404aa768
-
SHA1
6f2fad9bd35f51576b8d07be4ce348a24bfd6fab
-
SHA256
3cd7b7303d14fffed44e13ebfbd0a38fdbba39adc902ff5985d30f70ff2426f0
-
SHA512
a7b0db150de8abc2b11e465536618863a0f864030529560460f2c6882832f248d7b3168b740c4eebf782ba7a1cb7982dfdfa7fc58a39f223b85a01b922b90e66
Static task
static1
Behavioral task
behavioral1
Sample
SOR Price 062820KATARA PROJECT - MECH SOR (Tender).exe
Resource
win7
Malware Config
Extracted
lokibot
http://79.124.8.8/plesk-site-preview/chongelctricals.com/http/79.124.8.8/china/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
SOR Price 062820KATARA PROJECT - MECH SOR (Tender).exe
-
Size
598KB
-
MD5
ee1301ef174dab2858125132404aa768
-
SHA1
6f2fad9bd35f51576b8d07be4ce348a24bfd6fab
-
SHA256
3cd7b7303d14fffed44e13ebfbd0a38fdbba39adc902ff5985d30f70ff2426f0
-
SHA512
a7b0db150de8abc2b11e465536618863a0f864030529560460f2c6882832f248d7b3168b740c4eebf782ba7a1cb7982dfdfa7fc58a39f223b85a01b922b90e66
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-