Overview

overview

10

Static

static

Purchase Inquiry.exe

windows7-x64

10

Purchase Inquiry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL Delivery Receipt.rar

  • Size

    549KB

  • Sample

    221129-qms6xscg29

  • MD5

    d42398e78ad338a9db2d41555b83a124

  • SHA1

    ecfa9d34257e20dc3479ad22e0589397159eb4f3

  • SHA256

    b5e1300535a9b0d14d11484d324482de5ed74f513e22a362ed456bfb586587e5

  • SHA512

    8b246054b26faecc95176cbec2bf703da885d9c12b840b261ff0d51603883316c7c70e967718c4998cf57c3c8c24eb50dcf936c45af0dbe1ed4b4ed6d581d7e9

  • SSDEEP

    12288:UsCCAxdLtwabtFcAJIpxUPO+exoL3ACXBagBF8+904F4BszOPdcFyDHH/9:dvAxdC2qGIE/exc3ACzBFjrxyDHHl

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://157.245.36.27/~dokterpol/?page=14914169539334

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Purchase Inquiry.exe

    • Size

      629KB

    • MD5

      b47adf27915c7af2a24fc9081dff22f7

    • SHA1

      d0ae952ed86784b05b913d666d2fd1a5fb1c746e

    • SHA256

      208591b78135b397fcf22a58338bea5c086935362fb5e255e40ecb1a78245209

    • SHA512

      92c4f67842bc7bf6923b8d53a10f719e4be5efd52b531256a41bf870fe6036817c29adfb80881a14fe63ead9fb6fd74086885e1c37d3287d7aefc505e241823a

    • SSDEEP

      12288:k17BPDV/nJCDSwf8Ak8ZW3CFx8FGw3gdfxDeu6PFc2T+g:27hDlXwf8CxWGZdfxDeuI+

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks