Overview

overview

10

Static

static

SPARE PART...t.xlsx

windows7_x64

10

SPARE PART...t.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SPARE PARTS Provision List.xlsx

  • Size

    1.2MB

  • Sample

    210722-y12tsqzwen

  • MD5

    9454a3ea2dac9225f4abc69f756846cd

  • SHA1

    8324929668e11b31004bc4a8202a32c116ab4072

  • SHA256

    4113fcec8ddd5fa1e0a65985e3ca3082de37bc602add7ce11dc98ce4daf012b1

  • SHA512

    568391ec4f225aefd0afc9086faf8a0ef8f2bc9148dc937eefdb393c0cb0baf9bff409dcf71198de5e9b2cacde44dba57d25e53da0fc4b4f8a42f51955968382

Score
10/10
lokibotspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://manvim.co/fd5/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      SPARE PARTS Provision List.xlsx

    • Size

      1.2MB

    • MD5

      9454a3ea2dac9225f4abc69f756846cd

    • SHA1

      8324929668e11b31004bc4a8202a32c116ab4072

    • SHA256

      4113fcec8ddd5fa1e0a65985e3ca3082de37bc602add7ce11dc98ce4daf012b1

    • SHA512

      568391ec4f225aefd0afc9086faf8a0ef8f2bc9148dc937eefdb393c0cb0baf9bff409dcf71198de5e9b2cacde44dba57d25e53da0fc4b4f8a42f51955968382

    Score
    10/10
    lokibotspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks