Overview

overview

10

Static

static

Arrival notice.xlsx

windows7_x64

10

Arrival notice.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Arrival notice.xlsx

  • Size

    1.3MB

  • Sample

    210727-f1ywpk13ej

  • MD5

    0274a495e9ef20a4b3bfd274695d79b7

  • SHA1

    90c81259b0c08ece4698d440cbbb9dd5add9a4b7

  • SHA256

    9aea6342f41054eab27667160a40eada41c346b75cd2d31977f6d65d63c00fa3

  • SHA512

    87a0da0ccc539a64aa57d8feef8d76a4a55d3a8771428d52bfa7dcc8a081b23087cc01e6f6a322b6d378d3bce7378634ee5fdb28262606c0a1427898befa2b26

Score
10/10
lokibotspywarestealersuricatatrojan

Malware Config

Extracted

Family

lokibot

C2

http://manvim.co/fd5/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Arrival notice.xlsx

    • Size

      1.3MB

    • MD5

      0274a495e9ef20a4b3bfd274695d79b7

    • SHA1

      90c81259b0c08ece4698d440cbbb9dd5add9a4b7

    • SHA256

      9aea6342f41054eab27667160a40eada41c346b75cd2d31977f6d65d63c00fa3

    • SHA512

      87a0da0ccc539a64aa57d8feef8d76a4a55d3a8771428d52bfa7dcc8a081b23087cc01e6f6a322b6d378d3bce7378634ee5fdb28262606c0a1427898befa2b26

    Score
    10/10
    lokibotspywarestealersuricatatrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • suricata: ET MALWARE LokiBot Checkin

      suricata

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks