Overview

overview

10

Static

static

1

DRAFT FCR.exe

windows7-x64

10

DRAFT FCR.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c906261f49260da13459ec939ae7d28d

  • Size

    994KB

  • Sample

    220929-xbt3eacfhk

  • MD5

    c906261f49260da13459ec939ae7d28d

  • SHA1

    a5561b1458e4a6411cfe0cda8cf0af096a2cc194

  • SHA256

    9e08adec6e70f3bcc1cacd9512cf7ba7a1592b848e1c00996896f118ce744e09

  • SHA512

    f1e30fe47b26ebc76708bad26d0b8cfe0d84ba33a6081bb34120d10982b5c98391f487c7ea2a4950c4668c19bf31921adc5a27c4aa49b5904047c9f9f584ee5f

  • SSDEEP

    24576:IL4XOAXpqo5/kuJ8Hq8Y0yrlc2k5DQ7nAipKwJk:IfZo5y14laDiAYe

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gk17/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      DRAFT FCR.exe

    • Size

      931KB

    • MD5

      62c8dbcd33abd9350c3a260bc739440c

    • SHA1

      1afeb4b6e349eac8c3d47b317d8ac754690c4961

    • SHA256

      2d298cd1f78a6a239b173d32a4e9cf6a6e62ff06858c10a97ed947519c4fd666

    • SHA512

      b7611d20f0d12f2b99b2103ff341028ac8050df1ad732e164619bdf3d49cf4fab2cdaabccd3763cac4e6487910b563f5d25b154e94e21ee64129935b08200616

    • SSDEEP

      24576:Wq8eSoMZRuicOeJwFiJcUItBVqKYKgxcjSuqwCBOrn:CDoaRP1aJcUislTs

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks