General
-
Target
PO 1001873.xlsx
-
Size
176KB
-
Sample
220704-jfss9ahea9
-
MD5
336bce75fab2c892587c5d6d3b27c360
-
SHA1
60c8262aba8872e7d33451950107a5c1101933be
-
SHA256
aa4c2e7346fc37bbf38fed52341d14b84b56cfe523c1d6f8e0eccea78f257e22
-
SHA512
5a0e3a1c4f313987681ea91b362d2883a71f20091cc967598050f59cfc5917364d5ad46aa1e4c67a12154ca0f4331aae0b32f1e1e8956a8a8d1a32f5ea4813a7
Malware Config
Extracted
lokibot
http://45.133.1.20/rostov2/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
http://�����������Ѝ������Й���Й��я��
Targets
-
-
Target
PO 1001873.xlsx
-
Size
176KB
-
MD5
336bce75fab2c892587c5d6d3b27c360
-
SHA1
60c8262aba8872e7d33451950107a5c1101933be
-
SHA256
aa4c2e7346fc37bbf38fed52341d14b84b56cfe523c1d6f8e0eccea78f257e22
-
SHA512
5a0e3a1c4f313987681ea91b362d2883a71f20091cc967598050f59cfc5917364d5ad46aa1e4c67a12154ca0f4331aae0b32f1e1e8956a8a8d1a32f5ea4813a7
Score10/10-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
-
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
-
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot Fake 404 Response
suricata: ET MALWARE LokiBot Fake 404 Response
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1
-
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
-
suricata: ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
suricata: ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-