Overview

overview

10

Static

static

PROJECT_EB...df.exe

windows7_x64

10

PROJECT_EB...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PROJECT_EB200_RFQ_ITEMS_DOCUMENTS.pdf.exe

  • Size

    427KB

  • Sample

    210503-2pctw8g9en

  • MD5

    d3e359abdef108edbabf23b3c44a13b3

  • SHA1

    c0bd95902a800bae5f8625f7216860612a6db558

  • SHA256

    9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc

  • SHA512

    2246d49036d995bbcd564d11cf95d5203f89361f92f8fd202593992c8beb9b161ebbff2d9b517e5e5e4803790678a387e14f8f605b50548a7c0e4bef89a5660c

Score
10/10
lokibotagilenetpersistencespywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://104.168.175.179/ghost1/panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      PROJECT_EB200_RFQ_ITEMS_DOCUMENTS.pdf.exe

    • Size

      427KB

    • MD5

      d3e359abdef108edbabf23b3c44a13b3

    • SHA1

      c0bd95902a800bae5f8625f7216860612a6db558

    • SHA256

      9ffb3c0b779a35579c5555c7475870fdaaabed8b7bc9a8bf2805917f51e9a2cc

    • SHA512

      2246d49036d995bbcd564d11cf95d5203f89361f92f8fd202593992c8beb9b161ebbff2d9b517e5e5e4803790678a387e14f8f605b50548a7c0e4bef89a5660c

    Score
    10/10
    lokibotagilenetpersistencespywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks