Overview

overview

10

Static

static

1

16f716620d...41.exe

windows7_x64

10

16f716620d...41.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16f716620dd5c0151f14e9972ceece41.exe

  • Size

    243KB

  • Sample

    220125-naagyafaa9

  • MD5

    16f716620dd5c0151f14e9972ceece41

  • SHA1

    3769c9137ba48a84d40988d7ced98a61f3825c9b

  • SHA256

    f1ae5e52aa46bb46482d99dd0acf855320c71f8388c86195a6df94d02235ff84

  • SHA512

    cc01211f6bc71bfbf8de21f3a04b0944cc7be82dfdacaa0b47ac564f686ed7a4c28888e23d68feadb196d4a856cda06683b79a33f92cb38b1d9ed72903f622aa

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://augmentinprod.ir/jin/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      16f716620dd5c0151f14e9972ceece41.exe

    • Size

      243KB

    • MD5

      16f716620dd5c0151f14e9972ceece41

    • SHA1

      3769c9137ba48a84d40988d7ced98a61f3825c9b

    • SHA256

      f1ae5e52aa46bb46482d99dd0acf855320c71f8388c86195a6df94d02235ff84

    • SHA512

      cc01211f6bc71bfbf8de21f3a04b0944cc7be82dfdacaa0b47ac564f686ed7a4c28888e23d68feadb196d4a856cda06683b79a33f92cb38b1d9ed72903f622aa

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks