Overview

overview

10

Static

static

Oriental S...df.exe

windows7_x64

10

Oriental S...df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7419afdc1c915e139b49ab6d328b552bdf94f0f36babd0923cd18dcd043d4b93

  • Size

    394KB

  • Sample

    220521-ne4lksggbj

  • MD5

    639293c7018195f44c6310d273c5710e

  • SHA1

    88b930c04ba7f099189ec651a8c0b65d4ebe9378

  • SHA256

    7419afdc1c915e139b49ab6d328b552bdf94f0f36babd0923cd18dcd043d4b93

  • SHA512

    9eb5059481da0c891513d75583d8d02f5e9999c9107471a88e31ae22b62ee78424d388255dcfaf01d5cfba88d8355d1b4cfe67a963a6c06a3001a00e1b9992c5

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://kibossuqar.com/kaka/kaka3/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Oriental Spirit-parts 121SE20-0033 51 5659 60 - pdf.exe

    • Size

      545KB

    • MD5

      d7b70938804e6bf813446a2e55f5cc62

    • SHA1

      2c1f13811b1f62e7ae71404f3174d5c7417848b8

    • SHA256

      5312fab3ad83a00863c90baec3bbe7f1265cc6d94398b364f2cd7c11369af074

    • SHA512

      e921192806d02658f571d23ce43a870bf532750a052f0a73d192264a87a68d32e05f771ece66b59e20228466d23f3b4abeabf87b7146ab9cdf86cfde90ba6e5f

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks