Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    825b7e40d0e8bd99cf623386f74a97db1dc5b9317fc0df9ed1b108a7fbbd817d

  • Size

    615KB

  • Sample

    230131-dzdksaee27

  • MD5

    f9ef1fe311686cb5fe268707df8bd971

  • SHA1

    7a9fcdbb9e8c9f95a4fd5cefa00078eb2503bf14

  • SHA256

    825b7e40d0e8bd99cf623386f74a97db1dc5b9317fc0df9ed1b108a7fbbd817d

  • SHA512

    86f492767d31e0dac0f3bc4d503c71766420e819f2d9e701454ee6002a3edfbb9c313b5742c0188c48d2a18c627cd2a61de89a5a50410f8dc9a07c96b69191a3

  • SSDEEP

    12288:sqNXsnu0b+NoexY/PrMERjU/u0pNQ5JGJNnuPG9TlT:rs3+NNx8PI/uSG5JG7nuu9Tl

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/zang/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      825b7e40d0e8bd99cf623386f74a97db1dc5b9317fc0df9ed1b108a7fbbd817d

    • Size

      615KB

    • MD5

      f9ef1fe311686cb5fe268707df8bd971

    • SHA1

      7a9fcdbb9e8c9f95a4fd5cefa00078eb2503bf14

    • SHA256

      825b7e40d0e8bd99cf623386f74a97db1dc5b9317fc0df9ed1b108a7fbbd817d

    • SHA512

      86f492767d31e0dac0f3bc4d503c71766420e819f2d9e701454ee6002a3edfbb9c313b5742c0188c48d2a18c627cd2a61de89a5a50410f8dc9a07c96b69191a3

    • SSDEEP

      12288:sqNXsnu0b+NoexY/PrMERjU/u0pNQ5JGJNnuPG9TlT:rs3+NNx8PI/uSG5JG7nuu9Tl

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks