Overview

overview

10

Static

static

ad803880db...76.exe

windows7_x64

10

ad803880db...76.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad803880dbb40f2776e5e149ebce583a1eee4a8628d34849bb72923d42529076.exe

  • Size

    178KB

  • Sample

    220514-q5jp7shhg7

  • MD5

    c85a753c46e005748eb59d6d062d596c

  • SHA1

    396d1f6cbcf4e06965f270b7d5aa67ce784cec6b

  • SHA256

    ad803880dbb40f2776e5e149ebce583a1eee4a8628d34849bb72923d42529076

  • SHA512

    a56eceb55e81e1d83bc3ea11db2889cb1c0c4d907d1d232cfdaecbf9a1ddfa927b70702e32064471841379291eb3e825f22ae5a3dad72ead3aaa763fb48d4980

Score
10/10
lokibotcollectionspywarestealersuricatatrojan

Malware Config

Extracted

Family

lokibot

C2

http://vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      ad803880dbb40f2776e5e149ebce583a1eee4a8628d34849bb72923d42529076.exe

    • Size

      178KB

    • MD5

      c85a753c46e005748eb59d6d062d596c

    • SHA1

      396d1f6cbcf4e06965f270b7d5aa67ce784cec6b

    • SHA256

      ad803880dbb40f2776e5e149ebce583a1eee4a8628d34849bb72923d42529076

    • SHA512

      a56eceb55e81e1d83bc3ea11db2889cb1c0c4d907d1d232cfdaecbf9a1ddfa927b70702e32064471841379291eb3e825f22ae5a3dad72ead3aaa763fb48d4980

    Score
    10/10
    lokibotcollectionspywarestealersuricatatrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

      suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

      suricata

    • suricata: ET MALWARE LokiBot Checkin

      suricata: ET MALWARE LokiBot Checkin

      suricata

    • suricata: ET MALWARE LokiBot Fake 404 Response

      suricata: ET MALWARE LokiBot Fake 404 Response

      suricata

    • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

      suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

      suricata

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks