Overview

overview

10

Static

static

COPY-L41010_pdf.exe

windows7_x64

10

COPY-L41010_pdf.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3c1549c587d99a02129d40145e727350f9694c0faa19bd50c6b224b744ed82de

  • Size

    403KB

  • Sample

    220521-m499zsgbdn

  • MD5

    5239080a5c8d201cfa99f24ddd1233bc

  • SHA1

    f0c5fa3c8c87c9ef59480015f87d22d356b717a4

  • SHA256

    3c1549c587d99a02129d40145e727350f9694c0faa19bd50c6b224b744ed82de

  • SHA512

    7fec82905ff7582567a1610a5ef6573133ded6af43bd3cc11af68a99fbba6c79621322856c311b072a7d735ba37a066bc8479bd735fe963aa3b5550b56d2807a

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Targets

    • Target

      COPY-L41010_pdf.exe

    • Size

      643KB

    • MD5

      f6c019ac43560b1f1c67ced2d40300f6

    • SHA1

      62161a4aadc0e91a87af5fccb76e1f109977cfa5

    • SHA256

      d3f6aadfe6a7794bfc6394f6f65e83127696d959c0d79b1de0eb483e75b3be01

    • SHA512

      f324b4b4b03a65a6f23e272ab85dd974540b6ca4a998cd64b4708ac9e1ec484eec646106d4ddbf9e814b35ac82f6655c66f56fbc80a9ffeb09776f57ad3a75f8

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks