General

  • Target

    Factura comercial.exe

  • Size

    556KB

  • Sample

    210727-f97gp1j5j6

  • MD5

    0d4b6d93b2c7624ac7ba28315445380a

  • SHA1

    df99bf7d6297a448aa27e4c6e5676d0a1b43a5c4

  • SHA256

    5ed35d6d4d4045dddaba338ea5d2858a699e1cafa80077151ad6d2923121af8e

  • SHA512

    a29d3b067e136cafd9d5513f1ffebf74e2152ed78c6c6cde7a544a895fcfe5d2447a29809e9a2f8bf5388b5dcaed59ac9a124c5f1c19e2d9b994c05586d5dfd9

Malware Config

Extracted

Family

lokibot

C2

https://pakilogs2020.xyz/t/e/ff.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Factura comercial.exe

    • Size

      556KB

    • MD5

      0d4b6d93b2c7624ac7ba28315445380a

    • SHA1

      df99bf7d6297a448aa27e4c6e5676d0a1b43a5c4

    • SHA256

      5ed35d6d4d4045dddaba338ea5d2858a699e1cafa80077151ad6d2923121af8e

    • SHA512

      a29d3b067e136cafd9d5513f1ffebf74e2152ed78c6c6cde7a544a895fcfe5d2447a29809e9a2f8bf5388b5dcaed59ac9a124c5f1c19e2d9b994c05586d5dfd9

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • suricata: ET MALWARE LokiBot Checkin

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks