Overview

overview

10

Static

static

a200f5e82f...1e.exe

windows7-x64

10

a200f5e82f...1e.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a200f5e82fa4109462ed1dac5eba11b954c96ab96efdeac7b11c2dd17b43981e

  • Size

    642KB

  • Sample

    221125-cyqnaaef79

  • MD5

    56f5170cede8e554532c2054085e8d2e

  • SHA1

    bb009d7237a7ea6d87ff234ce880a6819d4aa152

  • SHA256

    68c658cf8865ef01523d5d754e4443f4766841cc18f62d1acfd5733dee696dff

  • SHA512

    d4b782fea4183071a973523215b21c32429b0768bc33b8d3a28fd014ed844090f889d42373f013739ebf5014a239a36147d3b3a1a036c8cf2292fb8aa485e30e

  • SSDEEP

    12288:t54uh/I2gPcVwASmp6J9naOI0/yfDJwf+UgdOZAD2SXxBBgA3byH9X7t4QyVJsQ6:c6/I3kVJQ9nSDJRHdCXSJDeHht4QyVWv

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://208.67.105.148/victor/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      a200f5e82fa4109462ed1dac5eba11b954c96ab96efdeac7b11c2dd17b43981e

    • Size

      779KB

    • MD5

      02237db1818eabb63695ec09488cc807

    • SHA1

      8b16401d38798ea34e73c1763c60c5349d422d91

    • SHA256

      a200f5e82fa4109462ed1dac5eba11b954c96ab96efdeac7b11c2dd17b43981e

    • SHA512

      c02f37922254dc97e4d3269cbe5aa3003584dff91f8c970839b4448d1db8b7aa00d9e34ae79f674c3cf33e5e567e8788cf9bb2813bee4bd52644b20485357ead

    • SSDEEP

      24576:hjNI3kVZQ7bUDJppdejwJjeHPteQy5aC:nI3YSHUlppd2wJKVyF

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks