Overview

overview

10

Static

static

PURCHASE O...34.rtf

windows7-x64

10

PURCHASE O...34.rtf

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    PURCHASE ORDER.4036041334.doc

  • Size

    24KB

  • Sample

    221121-paktcahe94

  • MD5

    45fb8c89e503e86d0078c03305723aca

  • SHA1

    26098f3510983f3cffb6d86d861003ef8f88294c

  • SHA256

    5f5f4e0ab65f657ff487ef5e7f60c1d95e48957a1228838974aface195a0d30e

  • SHA512

    f260f78840aa3508428c7bfb1c04b6377f7f0dffd8f8bdb798f516f1f47a33e137ad65fd1187ed94c450dcec2db033717132c257939047861ce2093229de15d2

  • SSDEEP

    768:oFx0XaIsnPRIa4fwJMOeOyd76PCbsg+dbceu8dC:of0Xvx3EMFOydWPC4db+8dC

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/kelly/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      PURCHASE ORDER.4036041334.doc

    • Size

      24KB

    • MD5

      45fb8c89e503e86d0078c03305723aca

    • SHA1

      26098f3510983f3cffb6d86d861003ef8f88294c

    • SHA256

      5f5f4e0ab65f657ff487ef5e7f60c1d95e48957a1228838974aface195a0d30e

    • SHA512

      f260f78840aa3508428c7bfb1c04b6377f7f0dffd8f8bdb798f516f1f47a33e137ad65fd1187ed94c450dcec2db033717132c257939047861ce2093229de15d2

    • SSDEEP

      768:oFx0XaIsnPRIa4fwJMOeOyd76PCbsg+dbceu8dC:of0Xvx3EMFOydWPC4db+8dC

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks