Overview

overview

10

Static

static

1

4885682f23...a9.exe

windows7-x64

10

4885682f23...a9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4885682f23a3e4d30f36031e374829a9.exe

  • Size

    934KB

  • Sample

    230307-sa296sae48

  • MD5

    4885682f23a3e4d30f36031e374829a9

  • SHA1

    ae8221abf269868bfb9a46a14269081ccdb01a72

  • SHA256

    04806bf0d8bf3a0aeebceff61c565d2da8c2883a23098a2de284154d671f69eb

  • SHA512

    bb0908cdfa060eac78adf33cebae3596087ac8c959300fca6ee60b279b5ba97a8911f559e16608007d1511f6b12c96526037433392c64a1d5f409fb471552fac

  • SSDEEP

    24576:3wYNUfqBpsQ1GeA5bfyzjqLVHPLuRczV:/NH6nVD0yV

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/yan/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      4885682f23a3e4d30f36031e374829a9.exe

    • Size

      934KB

    • MD5

      4885682f23a3e4d30f36031e374829a9

    • SHA1

      ae8221abf269868bfb9a46a14269081ccdb01a72

    • SHA256

      04806bf0d8bf3a0aeebceff61c565d2da8c2883a23098a2de284154d671f69eb

    • SHA512

      bb0908cdfa060eac78adf33cebae3596087ac8c959300fca6ee60b279b5ba97a8911f559e16608007d1511f6b12c96526037433392c64a1d5f409fb471552fac

    • SSDEEP

      24576:3wYNUfqBpsQ1GeA5bfyzjqLVHPLuRczV:/NH6nVD0yV

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks