Overview

overview

10

Static

static

81201f9615...91.exe

windows7-x64

10

81201f9615...91.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81201f9615ecfb4c8efde08ddc68ed91.exe

  • Size

    492KB

  • Sample

    230123-xvef3age51

  • MD5

    81201f9615ecfb4c8efde08ddc68ed91

  • SHA1

    191c562c3ba1f5ad661fad616fd75da018d6d10e

  • SHA256

    e1b43a4ba3e06006328305893b4af467d63aeac6d0c9e43057a20b883e67c89b

  • SHA512

    d46ae4dadc6a64a0cc1bdd74835c2d78d6e3705dfea1e1e7578488e600a733639a8f620dee889e77760915848e32af55326003bdd4b1d7ed1b76e639f72f3b40

  • SSDEEP

    12288:WdMH66BnmUlosHkMG0AxS/ffVpESCYipRWUfmh:3HV0ipA6fNpESRipcUfm

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/kelly/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      81201f9615ecfb4c8efde08ddc68ed91.exe

    • Size

      492KB

    • MD5

      81201f9615ecfb4c8efde08ddc68ed91

    • SHA1

      191c562c3ba1f5ad661fad616fd75da018d6d10e

    • SHA256

      e1b43a4ba3e06006328305893b4af467d63aeac6d0c9e43057a20b883e67c89b

    • SHA512

      d46ae4dadc6a64a0cc1bdd74835c2d78d6e3705dfea1e1e7578488e600a733639a8f620dee889e77760915848e32af55326003bdd4b1d7ed1b76e639f72f3b40

    • SSDEEP

      12288:WdMH66BnmUlosHkMG0AxS/ffVpESCYipRWUfmh:3HV0ipA6fNpESRipcUfm

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks