Overview

overview

10

Static

static

10

d26b79f265...69.exe

windows7_x64

10

d26b79f265...69.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d26b79f2653547f7d7b4a5580a47d969.exe

  • Size

    294KB

  • Sample

    220223-ql86raaca8

  • MD5

    d26b79f2653547f7d7b4a5580a47d969

  • SHA1

    6e82af7ed6970fca7e1be62cf653742d072f1fba

  • SHA256

    6f975378cb65fa40e27b22cd6676e4385b46cdb0df3111cb94530a8615516281

  • SHA512

    f1d9c59cbeec45eb2fd5c97e45c970467f89d0754d96d49debd6b2f1957e834d696c99e1efda73321899d868c0b861703c9bdd19711e28f278059bea1fa7762a

Score
10/10
lokibotneshtacollectionpersistencespywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://164.90.194.235/?id=22044231991792986

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      d26b79f2653547f7d7b4a5580a47d969.exe

    • Size

      294KB

    • MD5

      d26b79f2653547f7d7b4a5580a47d969

    • SHA1

      6e82af7ed6970fca7e1be62cf653742d072f1fba

    • SHA256

      6f975378cb65fa40e27b22cd6676e4385b46cdb0df3111cb94530a8615516281

    • SHA512

      f1d9c59cbeec45eb2fd5c97e45c970467f89d0754d96d49debd6b2f1957e834d696c99e1efda73321899d868c0b861703c9bdd19711e28f278059bea1fa7762a

    Score
    10/10
    lokibotneshtacollectionpersistencespywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks