Overview

overview

10

Static

static

10

URGENT ORD...)].exe

windows7_x64

10

URGENT ORD...)].exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8651e049cc61cc15e6453ef5c63a6350c3e3018281898641cbb3125be2831843

  • Size

    244KB

  • Sample

    220521-ahm64sdben

  • MD5

    59f4cc83642a2d1d8403ddb20b8d9010

  • SHA1

    ddde8692751234108557140c2b9af108be4b82ac

  • SHA256

    8651e049cc61cc15e6453ef5c63a6350c3e3018281898641cbb3125be2831843

  • SHA512

    5ae66e8308a0a501cedc1b2a406072fd9997a06b3fd773e8e82db696595f7d7c6ee5fffde0cc83253b6bdea3dddf82f8e0a06864598aad5b72124becf4da75a3

Score
10/10
lokibotcollectioncoreentityspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://superson.cf/Darren/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      URGENT ORDER (1128839)].exe

    • Size

      595KB

    • MD5

      782040dfe7a260370bfb081fb3c1086c

    • SHA1

      bcff1188aff971286210fc3a2e4ed437a76607a1

    • SHA256

      c4e932b8211725c1cf075196b3c505dfaaaa16b3d96303561f3a4d4592310016

    • SHA512

      e84cb30fc711969bbe0aabf0285d76876d07fa3f17160798b50bb0607c522a3769e56d623f72ae64fb49989e5ba9bec319e024aa63cd2dbcc202cfbf2b55528f

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks