Overview

overview

10

Static

static

Forwarder ...el.exe

windows7-x64

10

Forwarder ...el.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Forwarder quotation - Kernel.exe

  • Size

    711KB

  • Sample

    221005-za9sksfgen

  • MD5

    f22106d9222270d7d4cc7e2d9e9657f7

  • SHA1

    24edd1e390664fae72b29055e78bb6611be5a483

  • SHA256

    a9a73832599c23235d4848598f993f942245a816f83578fdf58a93c1b164c680

  • SHA512

    018634f7f07b7e0804a3280b33871284acc9ce324004badedfbbace67e2a53731e084b7534983d9244239e9f6a2cd0e4098033a292edccd14deac3c917e13cde

  • SSDEEP

    6144:5spa6F2GhNCajJRv4FvXOewMaeqHg3LpUfZdSFVehKLY1QF/9VdxTVo1sWgvRe2v:Kp2iNz7MJ31Qg9YSFlVdEtmXYkA0y/V

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/jungletwo/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Forwarder quotation - Kernel.exe

    • Size

      711KB

    • MD5

      f22106d9222270d7d4cc7e2d9e9657f7

    • SHA1

      24edd1e390664fae72b29055e78bb6611be5a483

    • SHA256

      a9a73832599c23235d4848598f993f942245a816f83578fdf58a93c1b164c680

    • SHA512

      018634f7f07b7e0804a3280b33871284acc9ce324004badedfbbace67e2a53731e084b7534983d9244239e9f6a2cd0e4098033a292edccd14deac3c917e13cde

    • SSDEEP

      6144:5spa6F2GhNCajJRv4FvXOewMaeqHg3LpUfZdSFVehKLY1QF/9VdxTVo1sWgvRe2v:Kp2iNz7MJ31Qg9YSFlVdEtmXYkA0y/V

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks