General

  • Target

    NEW ORDER JULY.xlsx

  • Size

    176KB

  • Sample

    220705-pea5pshacm

  • MD5

    e1340ffef01f3c540b8d8aed16f58d43

  • SHA1

    b548f7cdb0eab25a36b114dd96d98a39e40f3131

  • SHA256

    2787520304835f13c294f0e6b81e0acea239c7d6a2fca3d839f2553fff5f94c9

  • SHA512

    4f46e5344b93ab0efac770ed4b4b223c7ead382d1939ee191351273592a96acc432d52da5fb7fa607599ffceb126aa20f029fc71d4f0c4e598c7d174cb6b0e96

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/ch/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      NEW ORDER JULY.xlsx

    • Size

      176KB

    • MD5

      e1340ffef01f3c540b8d8aed16f58d43

    • SHA1

      b548f7cdb0eab25a36b114dd96d98a39e40f3131

    • SHA256

      2787520304835f13c294f0e6b81e0acea239c7d6a2fca3d839f2553fff5f94c9

    • SHA512

      4f46e5344b93ab0efac770ed4b4b223c7ead382d1939ee191351273592a96acc432d52da5fb7fa607599ffceb126aa20f029fc71d4f0c4e598c7d174cb6b0e96

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

      suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

      suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2

    • suricata: ET MALWARE LokiBot Checkin

      suricata: ET MALWARE LokiBot Checkin

    • suricata: ET MALWARE LokiBot Fake 404 Response

      suricata: ET MALWARE LokiBot Fake 404 Response

    • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

      suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

      suricata: ET MALWARE LokiBot Request for C2 Commands Detected M2

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    • suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

      suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks