Overview

overview

10

Static

static

93df62f279...79.exe

windows7-x64

10

93df62f279...79.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    93df62f2796852e7c6d40994d5603f79.exe

  • Size

    600KB

  • Sample

    221125-wh1yvsdd32

  • MD5

    93df62f2796852e7c6d40994d5603f79

  • SHA1

    8cd2b63d2aa9bdfa45cc0813bd117c84b5312b46

  • SHA256

    22d9d96fe042841c8a547ab29fbd9e9f68104ad166c6add9f4c597d59f2788f8

  • SHA512

    ef084eba78ff4bad010d8e252f195e4d1c332c0f586ee917cd98aa15477d8eb2a5146fa0c4e44bfc4bc1752506d25e1e6cce636c5de4db9b0c902d307a722f95

  • SSDEEP

    12288:AcI7rT4tJ6v15YBTfwgC72GfQpjSCYmZJbxpDF:zIXT4t+2V4R72iCY

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/kelly/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      93df62f2796852e7c6d40994d5603f79.exe

    • Size

      600KB

    • MD5

      93df62f2796852e7c6d40994d5603f79

    • SHA1

      8cd2b63d2aa9bdfa45cc0813bd117c84b5312b46

    • SHA256

      22d9d96fe042841c8a547ab29fbd9e9f68104ad166c6add9f4c597d59f2788f8

    • SHA512

      ef084eba78ff4bad010d8e252f195e4d1c332c0f586ee917cd98aa15477d8eb2a5146fa0c4e44bfc4bc1752506d25e1e6cce636c5de4db9b0c902d307a722f95

    • SSDEEP

      12288:AcI7rT4tJ6v15YBTfwgC72GfQpjSCYmZJbxpDF:zIXT4t+2V4R72iCY

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks