Overview

overview

10

Static

static

PO – 211...e.xlsx

windows7_x64

10

PO – 211...e.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO – 211-2021-M-0280 0281e.xlsx

  • Size

    2.3MB

  • Sample

    210114-lkgtg1fsfj

  • MD5

    484385066d88e28b48f80db24e848bd0

  • SHA1

    95040022636d3926ff4835a9d491870338a084ca

  • SHA256

    b7ab6beac68ee70c13d1f631c5aa82b2ab7d286e3702054032c3046336996cf8

  • SHA512

    99d244d4ff12d812ef836287f5ef1ea4f27b8dc29ad9e7cf1e93e1f24f3a153396c22388373f132c811d7523ef49765777e9c433f51fd6b412826719b39a2f89

Score
10/10
lokibotspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://paciflxinc.com/zoro/zoro2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      PO – 211-2021-M-0280 0281e.xlsx

    • Size

      2.3MB

    • MD5

      484385066d88e28b48f80db24e848bd0

    • SHA1

      95040022636d3926ff4835a9d491870338a084ca

    • SHA256

      b7ab6beac68ee70c13d1f631c5aa82b2ab7d286e3702054032c3046336996cf8

    • SHA512

      99d244d4ff12d812ef836287f5ef1ea4f27b8dc29ad9e7cf1e93e1f24f3a153396c22388373f132c811d7523ef49765777e9c433f51fd6b412826719b39a2f89

    Score
    10/10
    lokibotspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks