Overview

overview

10

Static

static

PO 3619 & ...oc.exe

windows7_x64

10

PO 3619 & ...oc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f2065a7ac60be2a5d2dff5996643183bc20ffcc7c94fa15a37f915ddfae216b8

  • Size

    163KB

  • Sample

    220521-nyj2aahdfp

  • MD5

    346abf65d5e56bca93b664561de3f217

  • SHA1

    5771e538b9271a631227fd1c206ca286265fc463

  • SHA256

    f2065a7ac60be2a5d2dff5996643183bc20ffcc7c94fa15a37f915ddfae216b8

  • SHA512

    6ae5670970bd0891766829aca80155b4335f5898c5ff6a2bbebbc998b6da361257f1ee5de6acc21b7c5d7a1c18a390817bd4f918034056bf3746b26094481d0b

Score
10/10
lokibotcollectionspywarestealersuricatatrojan

Malware Config

Extracted

Family

lokibot

C2

http://coolgirlsnation.com/wp-includes/debere/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      PO 3619 & Samples.doc.exe

    • Size

      216KB

    • MD5

      17504fe1ae0b4d904292db60323e6f6d

    • SHA1

      ca12215d678ad8610239b1eb0e16aea970fe399e

    • SHA256

      aad5523265a79ab035af98f1a124dc8343f3cca42c2a5143048d5b9cb9dfc547

    • SHA512

      0599fbe8c1de8bfb6011bc68af08d6e3300cf0aac7afa60c02724acc3823670e490b7bd725d983dabe770a9c1dcf53c18a754ecf60072e100ea35916612de7ba

    Score
    10/10
    lokibotcollectionspywarestealersuricatatrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

      suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

      suricata

    • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

      suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

      suricata

    • suricata: ET MALWARE LokiBot Checkin

      suricata: ET MALWARE LokiBot Checkin

      suricata

    • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

      suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

      suricata

    • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

      suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

      suricata

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks