lokibot

General

Target

https://anonfiles.com/R1G9Zc79qe/Malware_Testing_rar
Sample

210302-pzhrrgvnls

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://172.98.192.214:443/cSVlo1FeFAInvJDJkZ9P99GLwSTqIGUF

Extracted

Family

lokibot

C2

http://becharnise.ir/fb2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

http://pitr0s.com/DJ/luck/fre.php

Extracted

Family

systembc

C2

fb01ddd.com:4039

fb01ddd.xyz:4039

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
server255.web-hosting.com
Port:
587
Username:
dakbooks@janrytwo.xyz
Password:
rK(gSd%NWaQ@

Targets

- Target
  
  https://anonfiles.com/R1G9Zc79qe/Malware_Testing_rar
Score

10^/10

lokibot metasploit snakekeylogger systembc xmrig agilenet backdoor dave evasion keylogger miner pyinstaller spyware stealer trojan upx
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Snake Keylogger
  Keylogger and Infostealer first seen in November 2020.
  stealer keylogger snakekeylogger
- Snake Keylogger Payload
- SystemBC
  SystemBC is a proxy and remote administration tool first seen in 2019.
  trojan systembc
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner Payload
  miner
- Dave packer
  Detects executable using a packer named 'Dave' by the community, based on a string at the end.
  dave
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1