Overview

overview

10

Static

static

c6216dc2be...67.exe

windows7_x64

10

c6216dc2be...67.exe

windows10-2004_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c6216dc2be2714f4ababe05db055291469d022432995247565e0a130830b1167.exe

  • Size

    122KB

  • Sample

    220425-yblayadae3

  • MD5

    3a03e80e3178b42899065511c3842b59

  • SHA1

    e374aae94e475aaa9a8ad7cb0a7f72c9e4e8c326

  • SHA256

    c6216dc2be2714f4ababe05db055291469d022432995247565e0a130830b1167

  • SHA512

    3895598a68d7e630d635c7cdab73339b14dae04a28e01f4b5ca06cafc3b912fed12a2c125def9b8385b2bc2ccda6d6d09ccf7cbf906046560ed8bc475c835722

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://panel-report-logs.ml/nnajnr/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      c6216dc2be2714f4ababe05db055291469d022432995247565e0a130830b1167.exe

    • Size

      122KB

    • MD5

      3a03e80e3178b42899065511c3842b59

    • SHA1

      e374aae94e475aaa9a8ad7cb0a7f72c9e4e8c326

    • SHA256

      c6216dc2be2714f4ababe05db055291469d022432995247565e0a130830b1167

    • SHA512

      3895598a68d7e630d635c7cdab73339b14dae04a28e01f4b5ca06cafc3b912fed12a2c125def9b8385b2bc2ccda6d6d09ccf7cbf906046560ed8bc475c835722

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks