Overview

overview

10

Static

static

copy-39091933_pdf.exe

windows7_x64

10

copy-39091933_pdf.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b03bf5e3e03001a7e82c5d26ca64d904c827a54fe550f5e406b14256874cf1e

  • Size

    464KB

  • Sample

    220521-n2hmmaeea4

  • MD5

    5c8d7433bd244c9a0ce8781729eb1d99

  • SHA1

    a3b8d9088ed5e203a0e66ecaa88459ae989da7ae

  • SHA256

    7b03bf5e3e03001a7e82c5d26ca64d904c827a54fe550f5e406b14256874cf1e

  • SHA512

    6cc3bc81c60ec2032ddc9e96acd2251f453becb6f0147ac1f71b6bca09bfe4f833371d168dde62a5ab57e802e0b88f307000dedba37d09de324ceae519ac6a3b

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Targets

    • Target

      copy-39091933_pdf.exe

    • Size

      836KB

    • MD5

      055bbfdb12bc2102caf4334bbe8c8dd1

    • SHA1

      8fd2283ec7f98a03cd672df3ccd2a5c36882b189

    • SHA256

      38c4f7a15c06f3d67acc05dab01ac88c14f1172fff24f197d4a2973d7318a07b

    • SHA512

      7c9342dc1e51d6ab8ffe07b6ffd165df45cd4bc7a834ea6beb8d1d25d829b7f853e5bdc93155e852c0098a34f2516041a13d6d1f14904fa97bd4b4d07549efdf

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks