Overview

overview

10

Static

static

3725770754...36.exe

windows7_x64

8

3725770754...36.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3725770754fde1737e19152597be005a87ed05d9b7b4ae6f260dd2a7d0eeb836.exe

  • Size

    865KB

  • Sample

    210113-zejb1694f2

  • MD5

    3d4ed43f618ea62dd6af3992d8caa2f3

  • SHA1

    9811b570755cbb8fd70c108dd4e0bdb37080a466

  • SHA256

    3725770754fde1737e19152597be005a87ed05d9b7b4ae6f260dd2a7d0eeb836

  • SHA512

    25d631b0b9fafb525c41f1b67bd3e854fbe9b4845afc1fcd8e02cd4836ee06be5158ebe5b70565dc47bab312cb7a009dd374f96eaa0b5b199864a82af19fb967

Score
10/10
lokibotspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

https://firenzelavori.lt/loki/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      3725770754fde1737e19152597be005a87ed05d9b7b4ae6f260dd2a7d0eeb836.exe

    • Size

      865KB

    • MD5

      3d4ed43f618ea62dd6af3992d8caa2f3

    • SHA1

      9811b570755cbb8fd70c108dd4e0bdb37080a466

    • SHA256

      3725770754fde1737e19152597be005a87ed05d9b7b4ae6f260dd2a7d0eeb836

    • SHA512

      25d631b0b9fafb525c41f1b67bd3e854fbe9b4845afc1fcd8e02cd4836ee06be5158ebe5b70565dc47bab312cb7a009dd374f96eaa0b5b199864a82af19fb967

    Score
    10/10
    lokibotspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks