Overview

overview

10

Static

static

5

payment receipt.xls

windows7-x64

10

payment receipt.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payment receipt.xls

  • Size

    1.1MB

  • Sample

    230123-xe8pzaeg36

  • MD5

    53a4e7a639e3bf137e774f213999bfd9

  • SHA1

    2dea7560d48680d0cdbd5ec281a10d0daaf73e72

  • SHA256

    6d60dd648580a7f4c65e6b7e695b1599aa696479fbe04867c78399f0ebf1feda

  • SHA512

    5f9adf281c805549d542baf5bbd10bb992417e3f9a4f8e0743c2da93a819c21c556de1f3fdbaf7fcef348e670b60ab1f30b605904938b2ae3c1d672fb2450372

  • SSDEEP

    24576:9Wm7+m7bZXXXXXXXXXXXXUXXXXXXXXXXXXXXrX5:

Score
10/10
lokibotcollectionmacrospywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/ha1/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      payment receipt.xls

    • Size

      1.1MB

    • MD5

      53a4e7a639e3bf137e774f213999bfd9

    • SHA1

      2dea7560d48680d0cdbd5ec281a10d0daaf73e72

    • SHA256

      6d60dd648580a7f4c65e6b7e695b1599aa696479fbe04867c78399f0ebf1feda

    • SHA512

      5f9adf281c805549d542baf5bbd10bb992417e3f9a4f8e0743c2da93a819c21c556de1f3fdbaf7fcef348e670b60ab1f30b605904938b2ae3c1d672fb2450372

    • SSDEEP

      24576:9Wm7+m7bZXXXXXXXXXXXXUXXXXXXXXXXXXXXrX5:

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks