6a371ddf0c4f48d20fd58646b4b84fd086c83d0700efd161efeadbe79432be40

General
Target

6a371ddf0c4f48d20fd58646b4b84fd086c83d0700efd161efeadbe79432be40

Size

1MB

Sample

220521-w9gz3aeebm

Score
10 /10
MD5

32d0dbdfeaa85bc7bbbac57844d90608

SHA1

baac336e8f880e38db9f809fbeda89e8d2ed54c9

SHA256

6a371ddf0c4f48d20fd58646b4b84fd086c83d0700efd161efeadbe79432be40

SHA512

da9ff44f8731d069ec71a440a3fef6b511e6d73c09531e64f833d4631d34887ef824e9d59be0195a688358a47464f4e3e4f8e3812167814e6ce0e6af78a70916

Malware Config

Extracted

Family lokibot
C2

http://attlogistics-vn.com/first/chief2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets
Target

BUSINESS TRANSACTION NOTICE ON COVID-19 DOCUMENT_pdf.exe

MD5

50f00fe8700006dafb0717fab9454a52

Filesize

1MB

Score
10/10
SHA1

a07043d38c4d20783d4b69fa2153a9ba1b46e8a8

SHA256

b54e9651f5a4cd0500cb048307ec03bae3acf0c23237a1de1970667bed51d5ce

SHA512

2221f015601b93e7c805f64929a39c1b0883045fc2ed50845182fa1e4c6f82ce773b44ba4f76e049347273b8cf07167f0023d103f5933dca726df47bcd74448a

Tags

Signatures

  • Lokibot

    Description

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    Tags

  • Accesses Microsoft Outlook profiles

    Tags

    TTPs

    Email Collection
  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
Command and Control
    Credential Access
      Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Tasks

                        static1

                        5/10