Overview

overview

10

Static

static

SALES OFFE...13.exe

windows7_x64

10

SALES OFFE...13.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d0ef1972be33c8538b13c284c66b2f3fb82fcc74ff6549865e78435fdda0ff20

  • Size

    472KB

  • Sample

    220521-mx84cacfe4

  • MD5

    07bf20eb68ab23cbc4177e496ee53ea0

  • SHA1

    7c1cc2f72c34adf50eca91e4fca70235d0259eb9

  • SHA256

    d0ef1972be33c8538b13c284c66b2f3fb82fcc74ff6549865e78435fdda0ff20

  • SHA512

    9c2880f831d073af4640b53526d8adaed97faeb062e7cd14d19f7e2f77de5b4a318ef0d1908744649780c39f2bbaf80d7cc2d25d700e4c40e3fe0a7cd09d8106

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Targets

    • Target

      SALES OFFER SQ-2000563-20200713.exe

    • Size

      851KB

    • MD5

      f8a93fd47e0bdeafe24278c34b021b13

    • SHA1

      ff057bf3e06a6dc5d9d908f37f73e03ae94831cf

    • SHA256

      a7dfc5f40953d849020c877f5bd07b18e8d064c12170eb74c5932a79c207968d

    • SHA512

      e29126f78a323558f6ccb5d7bc3c13eb469b469fe67020bf9a8fbecd839a6e043e3b853ecc3dfbf7136dd7acd24cf6dab3b0e121d6fd1bb7f88272d45f0fae9c

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks