Overview

overview

10

Static

static

CTM_PDF.exe

windows7-x64

10

CTM_PDF.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CTM_PDF.exe

  • Size

    371KB

  • Sample

    221004-gpqn5seggk

  • MD5

    03edb7fbc5c53ee76032c98e0985a9f4

  • SHA1

    fee61f7e498790554379ced66a6cee9fd0baa8ca

  • SHA256

    5b5f288fda05e0c17f37d266636a188d0c01c27c3f4d138b5e9b59f157d7851d

  • SHA512

    c7c2e251c29fd82302e1fb1d47c1ecf3faa3f02089f77f524411474f3839ee2dd71f64bed386883704ca0b67a43d5b2a8884117c38cab4a00b7c78fc89b61254

  • SSDEEP

    6144:lTouKrWBEu3/Z2lpGDHU3ykJ1tC/kF9jl7NU90v0R1htmOYPrLK:lToPWBv/cpGrU3y8tGy9jA0v0aVPS

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Targets

    • Target

      CTM_PDF.exe

    • Size

      371KB

    • MD5

      03edb7fbc5c53ee76032c98e0985a9f4

    • SHA1

      fee61f7e498790554379ced66a6cee9fd0baa8ca

    • SHA256

      5b5f288fda05e0c17f37d266636a188d0c01c27c3f4d138b5e9b59f157d7851d

    • SHA512

      c7c2e251c29fd82302e1fb1d47c1ecf3faa3f02089f77f524411474f3839ee2dd71f64bed386883704ca0b67a43d5b2a8884117c38cab4a00b7c78fc89b61254

    • SSDEEP

      6144:lTouKrWBEu3/Z2lpGDHU3ykJ1tC/kF9jl7NU90v0R1htmOYPrLK:lToPWBv/cpGrU3y8tGy9jA0v0aVPS

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks