Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Attached Documents FYV#07072020_pdf.exe

  • Size

    371KB

  • Sample

    200707-5bx1edryns

  • MD5

    b5de70712b8019f5209ea76c30d8874a

  • SHA1

    cf50c5c5ec01f992ce869f6f564d355426f81ec0

  • SHA256

    50823ae6e2e1cdf7aeb3fa1e9398ef0f5f7c244d22e3a1fce261aa0836bd02bd

  • SHA512

    872324c5e4e701be10af8c6f392578b5b5d8e5166ba068d5c5553e0cd899835e443c6377d747601b269b066bded5896fec3d2aeadca1f76add2cb73f51849886

Malware Config

Extracted

Family

lokibot

C2

http://beckhoff-th.com/chief/chief1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Attached Documents FYV#07072020_pdf.exe

    • Size

      371KB

    • MD5

      b5de70712b8019f5209ea76c30d8874a

    • SHA1

      cf50c5c5ec01f992ce869f6f564d355426f81ec0

    • SHA256

      50823ae6e2e1cdf7aeb3fa1e9398ef0f5f7c244d22e3a1fce261aa0836bd02bd

    • SHA512

      872324c5e4e701be10af8c6f392578b5b5d8e5166ba068d5c5553e0cd899835e443c6377d747601b269b066bded5896fec3d2aeadca1f76add2cb73f51849886

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks