Overview

overview

10

Static

static

DHL Expres...pt.exe

windows7-x64

10

DHL Expres...pt.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL Express Receipt.exe

  • Size

    953KB

  • Sample

    221004-l9mv7saee8

  • MD5

    99ebc46c20777bc409ac3b071e572ddf

  • SHA1

    aff3e22b95adce58fd677f55416f48c31b66fef1

  • SHA256

    a2c8da15bb671e4122238011b32c056de465a37ac51b4a5859f89d0c55f8c838

  • SHA512

    b1374857601ca7142edd4d1a8d1562bd49ebd05bfc64b74f72e1afeb7d7b0f3ced7dafe911020b3a674b1e5a5307392998df598968248531f2fdc7d7654f2854

  • SSDEEP

    12288:6K6K4HTNMA2fEngLtEuQA8a+cgLBaJ5wx:6t2fE+to1cg8J5wx

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://162.0.223.13/?zfkdYtHLPzjU8NYmyvhLkN8G1QZuI5Khl4vjyc5nMohVcgiLLAw5oEMpvMUd

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      DHL Express Receipt.exe

    • Size

      953KB

    • MD5

      99ebc46c20777bc409ac3b071e572ddf

    • SHA1

      aff3e22b95adce58fd677f55416f48c31b66fef1

    • SHA256

      a2c8da15bb671e4122238011b32c056de465a37ac51b4a5859f89d0c55f8c838

    • SHA512

      b1374857601ca7142edd4d1a8d1562bd49ebd05bfc64b74f72e1afeb7d7b0f3ced7dafe911020b3a674b1e5a5307392998df598968248531f2fdc7d7654f2854

    • SSDEEP

      12288:6K6K4HTNMA2fEngLtEuQA8a+cgLBaJ5wx:6t2fE+to1cg8J5wx

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks