Overview

overview

10

Static

static

Debit note...df.exe

windows7_x64

10

Debit note...df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    978fb60348a3c68aa7c7e7f31f53dceb7ca1bb56909877acb50d6e02ff8d0e5f

  • Size

    362KB

  • Sample

    220521-n113ksedg3

  • MD5

    57bc02abf45ceccff2f8847dbb81843a

  • SHA1

    2bf15dbb65a5cbe2d0cd60acadc91f32c5a87c96

  • SHA256

    978fb60348a3c68aa7c7e7f31f53dceb7ca1bb56909877acb50d6e02ff8d0e5f

  • SHA512

    689d7c3ccd1242615e5570fa652bc41c767d9624083480db6823d671c4f99163d4cc51d470e997c6784b29dd5042c018f44de6f5b3df73ac71de75de05144542

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Targets

    • Target

      Debit note May-20_pdf.exe

    • Size

      616KB

    • MD5

      c0a2d0e5fbc2c4cca88b1e22f1b91539

    • SHA1

      f5f772becbb8ee868b8e00f04459349a741723ac

    • SHA256

      f02f1aa81359a40dc5654db55fe211c8dff8c88a790d10089fcbca1840a84c3a

    • SHA512

      c8abb7a1f6144fecf12daa9a957197db9a60e87453fa367c0e781465c4a4d9d73866765a64b6a154bd7ce1a0cc6d44dbe2296175842f4638b1597cd7a975974a

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks