Overview

overview

10

Static

static

HBL#SFSLDT...R.xlsx

windows7-x64

10

HBL#SFSLDT...R.xlsx

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d1562b3f8f1bcaf3252e4afec9416d2

  • Size

    173KB

  • Sample

    220908-xydzpscebj

  • MD5

    0d1562b3f8f1bcaf3252e4afec9416d2

  • SHA1

    d2e402e7d4c2bf5500972246142b4710ce1af95c

  • SHA256

    d9c688aaded5e2cb5e044fa9f510483a0211555ca8ffde516eed837fe42fad62

  • SHA512

    bc100de2c8682978d979fd2397c41992d88ec207da5dd75a92302560d86d1370ec3dd4b4e48291789fe4df7148ca3e85c90f1f8581f7c5912a430e90fd6dd0ca

  • SSDEEP

    3072:PP5AxKSjH6zAgdQ1l8YgI488MDi9TKmvoj8d8P58NhmxMUBfm:PPsKeH6zlWOYgrM+9fv3uPaNsMUA

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://208.67.105.162/cloud2/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      HBL#SFSLDTG004-22 LCL CONTAINER.xlsx

    • Size

      100KB

    • MD5

      4a58e87883bdb81773a0ba002bf1e255

    • SHA1

      a1832b0b19d0fe264d1f3809551388dd6e881388

    • SHA256

      d4572ecacc6c6f619b0b457438d91251345f6070e031ad5aca2ea910756f03b1

    • SHA512

      3cb4f33e4a884ecfe791289401d6e0d4bef5ee80331ad59fc00623ade1a96fd61cbd2d59a5ad92c4a00699a671c46b6880cfb4c8b3c7bfa2ca2a6a97bba8b913

    • SSDEEP

      1536:6jJPcbzCXXta/cRGGuDaCdE4M0qh5LcP9jg7Eb52Pg8IGnXvNS4GvTttuFybpD9U:6jJkbUtDKvKh/PLcFkJp/iGFPX

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks