Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    99e2a2ff576947884f1b3019b01893b5e1df07e20187c9de9f274bbb971118db

  • Size

    1.0MB

  • Sample

    230303-s3sw7shf3z

  • MD5

    2217bb050416b894e5ccda35f737fd10

  • SHA1

    06f1feecb2915c2c33f2daefc620c463bc6afbfd

  • SHA256

    99e2a2ff576947884f1b3019b01893b5e1df07e20187c9de9f274bbb971118db

  • SHA512

    f1d2003258687650858cb0170fbe9657c4261ecba47f5093043a12b0bbc77533234ed3c1d90f243b55eb97b03ba3844f6be212df0bb8fc76323f27ff9c6e3e58

  • SSDEEP

    12288:P+h8PidZgHyjtA48a5nVsmRwDY9HpU22ty78eF9mqJma:I8PMnjxzLsY7BTJ

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/yan/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      99e2a2ff576947884f1b3019b01893b5e1df07e20187c9de9f274bbb971118db

    • Size

      1.0MB

    • MD5

      2217bb050416b894e5ccda35f737fd10

    • SHA1

      06f1feecb2915c2c33f2daefc620c463bc6afbfd

    • SHA256

      99e2a2ff576947884f1b3019b01893b5e1df07e20187c9de9f274bbb971118db

    • SHA512

      f1d2003258687650858cb0170fbe9657c4261ecba47f5093043a12b0bbc77533234ed3c1d90f243b55eb97b03ba3844f6be212df0bb8fc76323f27ff9c6e3e58

    • SSDEEP

      12288:P+h8PidZgHyjtA48a5nVsmRwDY9HpU22ty78eF9mqJma:I8PMnjxzLsY7BTJ

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks