Overview

overview

10

Static

static

5

BUSINESS T...df.exe

windows7_x64

10

BUSINESS T...df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a371ddf0c4f48d20fd58646b4b84fd086c83d0700efd161efeadbe79432be40

  • Size

    1.4MB

  • Sample

    220521-w9gz3aeebm

  • MD5

    32d0dbdfeaa85bc7bbbac57844d90608

  • SHA1

    baac336e8f880e38db9f809fbeda89e8d2ed54c9

  • SHA256

    6a371ddf0c4f48d20fd58646b4b84fd086c83d0700efd161efeadbe79432be40

  • SHA512

    da9ff44f8731d069ec71a440a3fef6b511e6d73c09531e64f833d4631d34887ef824e9d59be0195a688358a47464f4e3e4f8e3812167814e6ce0e6af78a70916

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://attlogistics-vn.com/first/chief2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      BUSINESS TRANSACTION NOTICE ON COVID-19 DOCUMENT_pdf.exe

    • Size

      1.9MB

    • MD5

      50f00fe8700006dafb0717fab9454a52

    • SHA1

      a07043d38c4d20783d4b69fa2153a9ba1b46e8a8

    • SHA256

      b54e9651f5a4cd0500cb048307ec03bae3acf0c23237a1de1970667bed51d5ce

    • SHA512

      2221f015601b93e7c805f64929a39c1b0883045fc2ed50845182fa1e4c6f82ce773b44ba4f76e049347273b8cf07167f0023d103f5933dca726df47bcd74448a

    Score
    10/10
    lokibotcollectionspywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks