Overview

overview

10

Static

static

1

Swift_copy...50.exe

windows7-x64

10

Swift_copy...50.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Swift_copy29850372950.exe

  • Size

    147KB

  • Sample

    221123-n2axsadc9y

  • MD5

    68efea212241f870e86b9fb2ad495fb5

  • SHA1

    d25600f109fb49d70267c40bb99105f01f92805b

  • SHA256

    5bd660220c19c632f61015729a2b2d94a062a3f0d84ddd49854407e9a5965449

  • SHA512

    e1a988c8aa23c0de4a72e0a3d64c798555dbc7c30902b31abd72aa634d4f4fc906f12a9d1d17d4c600ace0699e65c275205b370e8cc9033577b0fd6bb3d54d26

  • SSDEEP

    3072:WfJSq+ytGIon9KcSM9b5W1PSsJ+Bq303TzmtvMEcVqcorD:MEa0N9b5W1PDjtvME4qLD

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gl20/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Swift_copy29850372950.exe

    • Size

      147KB

    • MD5

      68efea212241f870e86b9fb2ad495fb5

    • SHA1

      d25600f109fb49d70267c40bb99105f01f92805b

    • SHA256

      5bd660220c19c632f61015729a2b2d94a062a3f0d84ddd49854407e9a5965449

    • SHA512

      e1a988c8aa23c0de4a72e0a3d64c798555dbc7c30902b31abd72aa634d4f4fc906f12a9d1d17d4c600ace0699e65c275205b370e8cc9033577b0fd6bb3d54d26

    • SSDEEP

      3072:WfJSq+ytGIon9KcSM9b5W1PSsJ+Bq303TzmtvMEcVqcorD:MEa0N9b5W1PDjtvME4qLD

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks