General
-
Target
Purchase Order #5000012803.exe
-
Size
241KB
-
Sample
220114-gvbr6sefe6
-
MD5
d62b8a5fdb90e9241ff0eef6ea035e32
-
SHA1
4e9e38dc4d01a649d927a933488477c5980fcb18
-
SHA256
95f5680fe4d7830a393aa84b2278051638f3c8105766c47a68c1f8981f38932b
-
SHA512
5878e0ab7e76e508499f14c077192a235a73312edaa030d0999370df6c82be56212e4258da19a8cf8f3417d0da8ba20b3e166e0b58611fc44194df2964e863fe
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order #5000012803.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Purchase Order #5000012803.exe
Resource
win10-en-20211208
Malware Config
Extracted
lokibot
http://slimpackage.com/slimfit/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Purchase Order #5000012803.exe
-
Size
241KB
-
MD5
d62b8a5fdb90e9241ff0eef6ea035e32
-
SHA1
4e9e38dc4d01a649d927a933488477c5980fcb18
-
SHA256
95f5680fe4d7830a393aa84b2278051638f3c8105766c47a68c1f8981f38932b
-
SHA512
5878e0ab7e76e508499f14c077192a235a73312edaa030d0999370df6c82be56212e4258da19a8cf8f3417d0da8ba20b3e166e0b58611fc44194df2964e863fe
Score10/10-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-