Overview

overview

10

Static

static

1de2822a0c...4a.exe

windows7_x64

10

1de2822a0c...4a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1de2822a0cb24fb21e63f7947634b9599f1301982d5d9cd0db9f51630724924a.exe

  • Size

    577KB

  • Sample

    220514-q5jefaccgk

  • MD5

    661d85ed787ccc3508d2f92f631f5e1f

  • SHA1

    2822bac7a9daab23ddaff806f69fc3f9ab33dd08

  • SHA256

    1de2822a0cb24fb21e63f7947634b9599f1301982d5d9cd0db9f51630724924a

  • SHA512

    539b01b807af8a4916abc825a242e5f875225f909d73db40873da6c8ccec6d09f69c29bb5bc7dbe66f98d0d0c34c0c885e3ce1facb505b8c53c9e678fc9200b3

Score
10/10
lokibotcollectionspywarestealersuricatatrojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gf10/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      1de2822a0cb24fb21e63f7947634b9599f1301982d5d9cd0db9f51630724924a.exe

    • Size

      577KB

    • MD5

      661d85ed787ccc3508d2f92f631f5e1f

    • SHA1

      2822bac7a9daab23ddaff806f69fc3f9ab33dd08

    • SHA256

      1de2822a0cb24fb21e63f7947634b9599f1301982d5d9cd0db9f51630724924a

    • SHA512

      539b01b807af8a4916abc825a242e5f875225f909d73db40873da6c8ccec6d09f69c29bb5bc7dbe66f98d0d0c34c0c885e3ce1facb505b8c53c9e678fc9200b3

    Score
    10/10
    lokibotcollectionspywarestealersuricatatrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

      suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

      suricata

    • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

      suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

      suricata

    • suricata: ET MALWARE LokiBot Checkin

      suricata: ET MALWARE LokiBot Checkin

      suricata

    • suricata: ET MALWARE LokiBot Fake 404 Response

      suricata: ET MALWARE LokiBot Fake 404 Response

      suricata

    • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

      suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

      suricata

    • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

      suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

      suricata

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks