Overview

overview

10

Static

static

8

INVOICE.EXE

windows7_x64

10

INVOICE.EXE

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INVOICE.EXE

  • Size

    388KB

  • Sample

    200709-h7zrnxnnkn

  • MD5

    2ef559b1285873486f2639d6998d0ed7

  • SHA1

    c9131b6c30b9522c711537ec1c715f3c1fc3d30a

  • SHA256

    bae75dd4f9b20cf70c03927276a3b96c77f71916bead7d15477499ab1d13d499

  • SHA512

    8abef1174f7b1ff3ea58e6ea24e50bd29281ed37201b8ad559b51a27c0f3af316be4fb130b18b8fc76cf9686b3fd92e1988be51a941f77a6e4bc3ea773c018d6

Score
10/10
lokibotspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://mecharnise.ir/ea1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      INVOICE.EXE

    • Size

      388KB

    • MD5

      2ef559b1285873486f2639d6998d0ed7

    • SHA1

      c9131b6c30b9522c711537ec1c715f3c1fc3d30a

    • SHA256

      bae75dd4f9b20cf70c03927276a3b96c77f71916bead7d15477499ab1d13d499

    • SHA512

      8abef1174f7b1ff3ea58e6ea24e50bd29281ed37201b8ad559b51a27c0f3af316be4fb130b18b8fc76cf9686b3fd92e1988be51a941f77a6e4bc3ea773c018d6

    Score
    10/10
    spywaretrojanstealerlokibot

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks