Overview

overview

10

Static

static

S358900.exe

windows7_x64

10

S358900.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    S358900.exe

  • Size

    569KB

  • Sample

    200709-m8wcvjpxfx

  • MD5

    d3c020c6b33a8038b06117aa7f8806e4

  • SHA1

    d254327ec1b4c484d431142eea0419da9fea9077

  • SHA256

    a01ca3af701f733763f0aefb7b77fd6b6af89d58f154dbdb8e8dc0a4aebed446

  • SHA512

    4a63e88f88ce0bc706a207ca46f5da51147ffa6029f20c16f0049f7048a28b7947aa32244842e9c46bc4cc3cadcdfcf523589a5d24ea91017e6c82f3d4ca5aca

Score
10/10
lokibotspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://abidjiaintl.ml/sethr/logs/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      S358900.exe

    • Size

      569KB

    • MD5

      d3c020c6b33a8038b06117aa7f8806e4

    • SHA1

      d254327ec1b4c484d431142eea0419da9fea9077

    • SHA256

      a01ca3af701f733763f0aefb7b77fd6b6af89d58f154dbdb8e8dc0a4aebed446

    • SHA512

      4a63e88f88ce0bc706a207ca46f5da51147ffa6029f20c16f0049f7048a28b7947aa32244842e9c46bc4cc3cadcdfcf523589a5d24ea91017e6c82f3d4ca5aca

    Score
    10/10
    trojanspywarestealerlokibot

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks