Overview

overview

10

Static

static

3e7b8a8ef4...78.exe

windows7_x64

10

3e7b8a8ef4...78.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e7b8a8ef41216834f9311a7ce4e2fbb1a48e18f691e21e229cb0199986c0778

  • Size

    410KB

  • Sample

    220701-h4wpdabbd3

  • MD5

    43bf9ca3e0496c7b8a81ab34397903ec

  • SHA1

    2240e97b4ac3ddafc292bc04e46893cd5433e9a5

  • SHA256

    3e7b8a8ef41216834f9311a7ce4e2fbb1a48e18f691e21e229cb0199986c0778

  • SHA512

    fd75f7ed02edf9539e7b6c17c67a3e7bb5506aa6a463cb2fb761df9133c7f8c58802fef2e256d1dd57b275582a7a3f8a64a8ac5d1284536f711c1754e527d8e5

Score
10/10
lokibotcollectionspywarestealersuricatatrojan

Malware Config

Extracted

Family

lokibot

C2

http://majesticraft.com/ema/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      3e7b8a8ef41216834f9311a7ce4e2fbb1a48e18f691e21e229cb0199986c0778

    • Size

      410KB

    • MD5

      43bf9ca3e0496c7b8a81ab34397903ec

    • SHA1

      2240e97b4ac3ddafc292bc04e46893cd5433e9a5

    • SHA256

      3e7b8a8ef41216834f9311a7ce4e2fbb1a48e18f691e21e229cb0199986c0778

    • SHA512

      fd75f7ed02edf9539e7b6c17c67a3e7bb5506aa6a463cb2fb761df9133c7f8c58802fef2e256d1dd57b275582a7a3f8a64a8ac5d1284536f711c1754e527d8e5

    Score
    10/10
    lokibotcollectionspywarestealersuricatatrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

      suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

      suricata

    • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

      suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

      suricata

    • suricata: ET MALWARE LokiBot Checkin

      suricata: ET MALWARE LokiBot Checkin

      suricata

    • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

      suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

      suricata

    • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

      suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

      suricata

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks