Overview

overview

10

Static

static

Roominglist.exe

windows7-x64

10

Roominglist.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Roominglist.exe

  • Size

    154KB

  • Sample

    221003-lvhb6shdel

  • MD5

    b7dacf3db239ca6eac22dec1e33d8d6e

  • SHA1

    bf397201b9e49e079af376568777e21daeb9e330

  • SHA256

    a5e3197260ba1af2869c876321feddcaff9840446e5094d8e881e06732b27454

  • SHA512

    d67dcd3180f204ca8f1fddf5d6277c3b66e7d58c0ab9952437eabe90374db2e11ce31afc49d53be4a4b2714af70c535100dc772b4f86a8dc550a382bcd529aaf

  • SSDEEP

    3072:HeRDjQWm62ssORQ8jRZm7BjNyBJYX4O+i7p2q8yBXq:WzBRQ8bSZyvCJP7

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

https://assaggip.tk/Eze/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Roominglist.exe

    • Size

      154KB

    • MD5

      b7dacf3db239ca6eac22dec1e33d8d6e

    • SHA1

      bf397201b9e49e079af376568777e21daeb9e330

    • SHA256

      a5e3197260ba1af2869c876321feddcaff9840446e5094d8e881e06732b27454

    • SHA512

      d67dcd3180f204ca8f1fddf5d6277c3b66e7d58c0ab9952437eabe90374db2e11ce31afc49d53be4a4b2714af70c535100dc772b4f86a8dc550a382bcd529aaf

    • SSDEEP

      3072:HeRDjQWm62ssORQ8jRZm7BjNyBJYX4O+i7p2q8yBXq:WzBRQ8bSZyvCJP7

    Score
    10/10
    lokibotcollectionspywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks