Overview

overview

10

Static

static

1

Purchase O...94.exe

windows7-x64

10

Purchase O...94.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    024d9f82d306df06bb3a9c5ef6122c6e

  • Size

    671KB

  • Sample

    221004-xz7cmsbhg9

  • MD5

    024d9f82d306df06bb3a9c5ef6122c6e

  • SHA1

    36b04ac1e1f27803cba24559bbf0ead79f599534

  • SHA256

    7cb46508d7a72ceaf60eafc5f9c3166d1329aa8e9a3a9e14e7cf5952edbf2a6b

  • SHA512

    5d692ea2470c1b337c7e285dc5cb655a5f16c4f8196ad746e7afecb80ac909778e96ef5d6937e9e9a83155735f3f70183108b5afde5ad191c43523d96bab3ae4

  • SSDEEP

    12288:iePoPQ77KVUAeDXvU5wtCf3OyxezE/ao4vi7rsq5OkX8Zlra9VOzo:iepDD4xYAaQ7DOkilrEVx

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://162.0.223.13/?05315

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Purchase Order no#100894.exe

    • Size

      949KB

    • MD5

      33a0fb90d362ed8d3a4ecd8d4ef6ecff

    • SHA1

      adaf7e746f89a370a6053588d996973efd7e9450

    • SHA256

      3462fa9634ad9ada7c6d07f2b48138fba9326e4771843da8a11a33bb618f265a

    • SHA512

      ae48efcec02c363d79b7b124b81c9339e1468117208de72ad280706e8df3fb7f12af0174f84da0165bd54ef6aaf07ff7871c6a8ef7dd2aeaeeabed7c6e0475d4

    • SSDEEP

      12288:cHK4HTNqNPt9WW3fYPcc94HFUOAA9j/sMeGlZUOF4g:BP3fYPcc9iHAisol73

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks