Overview

overview

10

Static

static

5

invoice-doc.exe

windows7_x64

10

invoice-doc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c45f927aab0265ab9ac338a91a37d2c0e513e91eb15a4cc80b032ea89a0c592e

  • Size

    758KB

  • Sample

    220521-w8dk9aedfm

  • MD5

    29686c7cd874b344236d68c1b8fc17bf

  • SHA1

    335666f731945440380541cde7e52d1b3e72bdac

  • SHA256

    c45f927aab0265ab9ac338a91a37d2c0e513e91eb15a4cc80b032ea89a0c592e

  • SHA512

    a8a0a57439ff7f8035fae257edd955d3253a15611123b99dd15b9cfd1b87da9f3afe7f58ee1c7f8951af8cfe4f6596dbe6e7ad5e0196df703b29290853514188

Score
10/10
lokibotcollectionspywarestealersuricatatrojan

Malware Config

Extracted

Family

lokibot

C2

http://eocaenlogistics.com/data/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      invoice-doc.exe

    • Size

      1.2MB

    • MD5

      43e0849c65f1dcb5694cea91824572c6

    • SHA1

      67f0f32e7ca3bbea968d2648f381e3f3fa2e1602

    • SHA256

      ca80e46167f7c8dd33ca38ecff1c2c19704a80735caa1c4b49498e0bc255b2cb

    • SHA512

      5d002e753c9261ccc953d533c8466a6a30a38ee869dbffb76a0be1de9a23fac3703d4e7d9b2e7a6b9fc04d6389cf23d2841499455875679850d94919156b7ac3

    Score
    10/10
    lokibotcollectionspywarestealersuricatatrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

      suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

      suricata

    • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

      suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

      suricata

    • suricata: ET MALWARE LokiBot Checkin

      suricata: ET MALWARE LokiBot Checkin

      suricata

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks