Overview

overview

10

Static

static

b7832b40a6...44.exe

windows7-x64

10

b7832b40a6...44.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b7832b40a6c74bf31e1dda25ba3cbb7838bce81ff9ca3bad62f652790c4a8844

  • Size

    490KB

  • Sample

    230129-yj3j7abd69

  • MD5

    d47dba3eb25a6af85e6916b3daa8e05a

  • SHA1

    75e0d5d5f514effc789a2ebc66b75d43a4691e4d

  • SHA256

    b7832b40a6c74bf31e1dda25ba3cbb7838bce81ff9ca3bad62f652790c4a8844

  • SHA512

    b35fc3caeb421e9930afeaf5009b6e11640b650dd02330ab14ca4d082d4cf00ae0560a6096bfb3a9c64e8568c73bb23395fc3d1becabcd24adecccdf4484d9df

  • SSDEEP

    12288:6WxM/E8tXXQhyvvM3TSAESbv7VMbTR4BlISop68:6zAhfTSAbv7abTR0mSop68

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://51.195.53.221/p.php/4XLikrLDgSWJ1

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      b7832b40a6c74bf31e1dda25ba3cbb7838bce81ff9ca3bad62f652790c4a8844

    • Size

      490KB

    • MD5

      d47dba3eb25a6af85e6916b3daa8e05a

    • SHA1

      75e0d5d5f514effc789a2ebc66b75d43a4691e4d

    • SHA256

      b7832b40a6c74bf31e1dda25ba3cbb7838bce81ff9ca3bad62f652790c4a8844

    • SHA512

      b35fc3caeb421e9930afeaf5009b6e11640b650dd02330ab14ca4d082d4cf00ae0560a6096bfb3a9c64e8568c73bb23395fc3d1becabcd24adecccdf4484d9df

    • SSDEEP

      12288:6WxM/E8tXXQhyvvM3TSAESbv7VMbTR4BlISop68:6zAhfTSAbv7abTR0mSop68

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks