Overview

overview

10

Static

static

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    tmp

  • Size

    970KB

  • Sample

    221014-psmqnaddg9

  • MD5

    0d1cace98bc4b91759bb562ded65aba6

  • SHA1

    45a60ee53e8cb3a03570ec9600d72ee536b0d0ab

  • SHA256

    5b99d5ef6117392c1d73a2a33c0834ee3e8a9856e4eed567908231080d717064

  • SHA512

    6fa57b21cc8cd22cc3f0a2c8e3a8e9a75dc572b46b54a83bccdda95072611b5b61c391407a72e3fa49f4ca2f2eac6966986b3356db36ce51e4303dde3e833c4e

  • SSDEEP

    12288:Vh/UzDlKOYJebfhuoUFsTzL7A4m6ZU456I3AEW6UPBXV+/lk2rZYSy9lH6mhCW:HUzDluJeVjXmaoBqiBFBF6qCW

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://208.67.105.162/smart/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      tmp

    • Size

      970KB

    • MD5

      0d1cace98bc4b91759bb562ded65aba6

    • SHA1

      45a60ee53e8cb3a03570ec9600d72ee536b0d0ab

    • SHA256

      5b99d5ef6117392c1d73a2a33c0834ee3e8a9856e4eed567908231080d717064

    • SHA512

      6fa57b21cc8cd22cc3f0a2c8e3a8e9a75dc572b46b54a83bccdda95072611b5b61c391407a72e3fa49f4ca2f2eac6966986b3356db36ce51e4303dde3e833c4e

    • SSDEEP

      12288:Vh/UzDlKOYJebfhuoUFsTzL7A4m6ZU456I3AEW6UPBXV+/lk2rZYSy9lH6mhCW:HUzDluJeVjXmaoBqiBFBF6qCW

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks