Overview

overview

10

Static

static

PO-099-13-21, dat.exe

windows7_x64

10

PO-099-13-21, dat.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO-099-13-21, dat

  • Size

    1.0MB

  • Sample

    210113-877g842382

  • MD5

    f590fca19aa4eaa3d59a2ed6f2c85c43

  • SHA1

    f29dce8692d1e35383d6933233925ed5a12f9b80

  • SHA256

    3ea4d93621845dc92c1d107b744cc193376978b230782bfc87bf3b9a985e5218

  • SHA512

    c53b4cc41dace6f60f9dc6b4873a2e27a6f162ee7abe27aa3454aa9f74e4ef24e6eff4137bdbf8b81d627fd2c5ad0b22e76b25184c9a0a7f9d29b6dc30cff8eb

Score
10/10
lokibotspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://becharnise.ir/fa2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      PO-099-13-21, dat

    • Size

      1.0MB

    • MD5

      f590fca19aa4eaa3d59a2ed6f2c85c43

    • SHA1

      f29dce8692d1e35383d6933233925ed5a12f9b80

    • SHA256

      3ea4d93621845dc92c1d107b744cc193376978b230782bfc87bf3b9a985e5218

    • SHA512

      c53b4cc41dace6f60f9dc6b4873a2e27a6f162ee7abe27aa3454aa9f74e4ef24e6eff4137bdbf8b81d627fd2c5ad0b22e76b25184c9a0a7f9d29b6dc30cff8eb

    Score
    10/10
    lokibotspywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks