Overview

overview

10

Static

static

iZdmfQkBlqMmmbz.exe

windows7_x64

10

iZdmfQkBlqMmmbz.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    iZdmfQkBlqMmmbz.exe

  • Size

    536KB

  • Sample

    210728-8ttep8ctan

  • MD5

    2402f165befaa33e3700592cb7defe4c

  • SHA1

    e1c0b072bf018dc8af85ff4972a7e0718a4c7bf7

  • SHA256

    cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3

  • SHA512

    ff5f1dac40696ba5875abd8baad70b6b5c2fad8485530c6a09217c5d1ce9cd57b761861aa4d07998b13f12f85353336332649b3b6fa036489cd95d8a5a89e322

Score
10/10
lokibotspywarestealersuricatatrojan

Malware Config

Extracted

Family

lokibot

C2

https://luoslasco.xyz/to/ya/vd.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      iZdmfQkBlqMmmbz.exe

    • Size

      536KB

    • MD5

      2402f165befaa33e3700592cb7defe4c

    • SHA1

      e1c0b072bf018dc8af85ff4972a7e0718a4c7bf7

    • SHA256

      cd71cf303bb183ffcf34487f8db9b3c05f517e0659b972153d5739422da9fbf3

    • SHA512

      ff5f1dac40696ba5875abd8baad70b6b5c2fad8485530c6a09217c5d1ce9cd57b761861aa4d07998b13f12f85353336332649b3b6fa036489cd95d8a5a89e322

    Score
    10/10
    lokibotspywarestealersuricatatrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • suricata: ET MALWARE LokiBot Checkin

      suricata

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks