General

  • Target
    8adc1207d03c751de9f90d03508198f1.exe
  • Size 165KB
  • Sample210203-xevf4wflra
  • SHA256 30a41d49e9b62d6a7f49ff2ce874cb985a5e5f8f1f13ab6e0f0a951d628bc0d7
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • lokibot

C2
  • http://klinklan.us/zoro/zoro3/fre.php

  • http://kbfvzoboss.bid/alien/fre.php

  • http://alphastand.trade/alien/fre.php

  • http://alphastand.win/alien/fre.php

  • http://alphastand.top/alien/fre.php

Targets

    • Target
      8adc1207d03c751de9f90d03508198f1.exe
    • Size 165KB
    • SHA256 30a41d49e9b62d6a7f49ff2ce874cb985a5e5f8f1f13ab6e0f0a951d628bc0d7
    • MD5 SHA1 SHA512
    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks