Overview

overview

10

Static

static

1

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    57e9ce8a8b2ed57e367fe58657005e73fd3bd1d13ad7de0a70b9bd46656737f8

  • Size

    123KB

  • Sample

    221025-f54ehabfem

  • MD5

    8467858258ab1ff22bde09e3405c02e7

  • SHA1

    192e5b740b9844d8586f31993fdabe8f5186e159

  • SHA256

    57e9ce8a8b2ed57e367fe58657005e73fd3bd1d13ad7de0a70b9bd46656737f8

  • SHA512

    74694d063ba37211cfbfc01b70f24a3e8b52de4a4adfb053e1c917800a8533634497e6994ab3eb5cdc3dd224c71750bcad4bb54f6f6d17cf92259c6820dcdbe0

  • SSDEEP

    3072:qUJoFfWzzl+cSMCDuMlDnEprVQwxI39hArLDTXPe22gQHvzs2:qweEpHMlEbQwx0h8TXYvs2

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gl6/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      57e9ce8a8b2ed57e367fe58657005e73fd3bd1d13ad7de0a70b9bd46656737f8

    • Size

      123KB

    • MD5

      8467858258ab1ff22bde09e3405c02e7

    • SHA1

      192e5b740b9844d8586f31993fdabe8f5186e159

    • SHA256

      57e9ce8a8b2ed57e367fe58657005e73fd3bd1d13ad7de0a70b9bd46656737f8

    • SHA512

      74694d063ba37211cfbfc01b70f24a3e8b52de4a4adfb053e1c917800a8533634497e6994ab3eb5cdc3dd224c71750bcad4bb54f6f6d17cf92259c6820dcdbe0

    • SSDEEP

      3072:qUJoFfWzzl+cSMCDuMlDnEprVQwxI39hArLDTXPe22gQHvzs2:qweEpHMlEbQwx0h8TXYvs2

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks