Overview

overview

10

Static

static

Outstandin...df.exe

windows7_x64

10

Outstandin...df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    34ca6d0865baf4fb4bb6427bccf68e5609f5d74c5f277483536570b3951a8d5d

  • Size

    142KB

  • Sample

    220521-px3mnsgbe5

  • MD5

    cb4d039497c10b799369b4f64cffb434

  • SHA1

    224211a46c5ab16e70d4ada7b9b553fdbfee1e9b

  • SHA256

    34ca6d0865baf4fb4bb6427bccf68e5609f5d74c5f277483536570b3951a8d5d

  • SHA512

    bbb8de9306291a0466eef29a221eb7e3f32045a7bbe9a1d4b268f5b2ab4a9eb6cc1fdb4d40cf890c9429e3088c887a77b6912e49c8b137d17b7a1c4c80766ecb

Score
10/10
lokibotagilenetcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://blesblochem.com/two/gates1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Outstanding_SOA_Payment_April_pdf.exe

    • Size

      305KB

    • MD5

      f2ff7f964069c2236a840e23dabaab7e

    • SHA1

      3175a26730edc37b3d8327b76640008466fc7e7c

    • SHA256

      1144e3bae3faea1e5b8e16a8afe431d07743cf87effdbe3b409dff8c9b1c6132

    • SHA512

      5c79d048febda6d07fe241df28e9ff2b5e5124d1104c63c0336bb2335b7af80f9e7081dd74cc6ee1ce966495c10620ab95f462278e15c77158f382543a9177c3

    Score
    10/10
    lokibotagilenetcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks