Overview

overview

10

Static

static

2c64af2b99...05.exe

windows7_x64

6

2c64af2b99...05.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c64af2b995ad6b33bc90f4103e1ae990db77c9c341279c0ab0af1c38d414405.exe

  • Size

    701KB

  • Sample

    200716-l2pbrdm8b6

  • MD5

    2806c78c2c26ff4aac0cb1c2904e843c

  • SHA1

    41efce46348dd2468457225ffec224b2a2e9fb78

  • SHA256

    2c64af2b995ad6b33bc90f4103e1ae990db77c9c341279c0ab0af1c38d414405

  • SHA512

    07e9795b48c5276de2fdee6fbb93575e15240bd7ecfe2413524a1470b83e280ade900a9cdbeebb78d486931d3dbb61d413c96990c4b7ab63a8fbb678145797ec

Score
10/10
lokibotpersistencespywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://asatech.cf/obama/five/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      2c64af2b995ad6b33bc90f4103e1ae990db77c9c341279c0ab0af1c38d414405.exe

    • Size

      701KB

    • MD5

      2806c78c2c26ff4aac0cb1c2904e843c

    • SHA1

      41efce46348dd2468457225ffec224b2a2e9fb78

    • SHA256

      2c64af2b995ad6b33bc90f4103e1ae990db77c9c341279c0ab0af1c38d414405

    • SHA512

      07e9795b48c5276de2fdee6fbb93575e15240bd7ecfe2413524a1470b83e280ade900a9cdbeebb78d486931d3dbb61d413c96990c4b7ab63a8fbb678145797ec

    Score
    10/10
    persistencespywaretrojanstealerlokibot

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks