Standard Chartered Bank.exe

General
Target

Standard Chartered Bank.exe

Size

498KB

Sample

210611-5hzbslp7f6

Score
10 /10
MD5

810e9eebba5cce5bf0d44cbb5e3b5a19

SHA1

bf031ef4b6b87f9e0cb2c540745614fb914475d4

SHA256

cabcc377f00b0aa676d3139e7f14fa7881c5f25875d5218e25645db7e129992c

SHA512

c6b33f8be189ff612388fd48f0e6bbeafbf7ec57b65133afbffe1484306288ed8dfe568bfe8d8e65b7bea9d819068f52d8dc073e1e9b45c145a338c06a02e9f1

Malware Config

Extracted

Family lokibot
C2

http://63.141.228.141/32.php/5l0ZnNa7AB6Dl

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets
Target

Standard Chartered Bank.exe

MD5

810e9eebba5cce5bf0d44cbb5e3b5a19

Filesize

498KB

Score
10 /10
SHA1

bf031ef4b6b87f9e0cb2c540745614fb914475d4

SHA256

cabcc377f00b0aa676d3139e7f14fa7881c5f25875d5218e25645db7e129992c

SHA512

c6b33f8be189ff612388fd48f0e6bbeafbf7ec57b65133afbffe1484306288ed8dfe568bfe8d8e65b7bea9d819068f52d8dc073e1e9b45c145a338c06a02e9f1

Tags

Signatures

  • Lokibot

    Description

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    Tags

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          1/10

                          behavioral2

                          10/10