Overview

overview

10

Static

static

gunzipped.exe

windows7_x64

10

gunzipped.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    gunzipped

  • Size

    896KB

  • Sample

    200717-zdptghll4x

  • MD5

    66eec316b93a7968b5c358d59854f23d

  • SHA1

    713faafe38c2011fc501c2137d0b26c7ce478603

  • SHA256

    9bbee036cc6c4bc82d4b9db724fe8184a2d3b9eb1a9e4fd491b617931642e540

  • SHA512

    e37fb5817b3dfb87e7f2170e1e08437f432830cfe0d4f5674bd6855226e0ad158620438a2877676f06f6381b3ff2ca3bd84e48b8032f319e4e08162a0dbaa459

Score
10/10
lokibotspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://niskioglasi.rs/test3/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      gunzipped

    • Size

      896KB

    • MD5

      66eec316b93a7968b5c358d59854f23d

    • SHA1

      713faafe38c2011fc501c2137d0b26c7ce478603

    • SHA256

      9bbee036cc6c4bc82d4b9db724fe8184a2d3b9eb1a9e4fd491b617931642e540

    • SHA512

      e37fb5817b3dfb87e7f2170e1e08437f432830cfe0d4f5674bd6855226e0ad158620438a2877676f06f6381b3ff2ca3bd84e48b8032f319e4e08162a0dbaa459

    Score
    10/10
    spywaretrojanstealerlokibot

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks