Overview

overview

10

Static

static

b0cc51f23a...98.exe

windows7_x64

10

b0cc51f23a...98.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0cc51f23ac5a30c25ecd9e817b445d66027872eff2dcbe9ea1808a945f6be98.exe

  • Size

    661KB

  • Sample

    200708-n9qk2yk2ce

  • MD5

    b6146ca5f17e754daba280ab48528172

  • SHA1

    7ca0ab50aa22e288a5386e3d87ea0454a9e056c2

  • SHA256

    b0cc51f23ac5a30c25ecd9e817b445d66027872eff2dcbe9ea1808a945f6be98

  • SHA512

    2f91cc31fb41bcdab598f7b7fecd10b759c5df39c523a53c057bfe25a41cb9f1d60789241f24d70bc0ed707383b7be3c7acedce7da8bf1cf9be95c973e6283fb

Score
10/10
lokibotspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

airmanselectiontest.com/oo/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      b0cc51f23ac5a30c25ecd9e817b445d66027872eff2dcbe9ea1808a945f6be98.exe

    • Size

      661KB

    • MD5

      b6146ca5f17e754daba280ab48528172

    • SHA1

      7ca0ab50aa22e288a5386e3d87ea0454a9e056c2

    • SHA256

      b0cc51f23ac5a30c25ecd9e817b445d66027872eff2dcbe9ea1808a945f6be98

    • SHA512

      2f91cc31fb41bcdab598f7b7fecd10b759c5df39c523a53c057bfe25a41cb9f1d60789241f24d70bc0ed707383b7be3c7acedce7da8bf1cf9be95c973e6283fb

    Score
    10/10
    spywaretrojanstealerlokibot

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks