Overview

overview

10

Static

static

1

Contract Inv..rtf

windows7-x64

10

Contract Inv..rtf

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    Contract Inv..doc

  • Size

    31KB

  • Sample

    230320-k116sscf64

  • MD5

    b4eed0d6dc956d9fc14886a6d4736d01

  • SHA1

    a461f7861b1d20c278457c5d43f203277bd427bd

  • SHA256

    db95fdd4458a5adc40e303cdae4b77a55742d557258201ede0e0e9800f48d499

  • SHA512

    d7e8fd60a612af09f76af29a663361697697622e8cab4ceeebc249da2e7e009f0f1e6ffacaba7b42124ced60dd80f69c6b69afb1873ae04f27b9e6918bfb26c1

  • SSDEEP

    768:lFx0XaIsnPRIa4fwJMaLWcOd3z3VdMprmKCdawhT2a:lf0Xvx3EMaLWltApmj0w4a

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/kelly/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Contract Inv..doc

    • Size

      31KB

    • MD5

      b4eed0d6dc956d9fc14886a6d4736d01

    • SHA1

      a461f7861b1d20c278457c5d43f203277bd427bd

    • SHA256

      db95fdd4458a5adc40e303cdae4b77a55742d557258201ede0e0e9800f48d499

    • SHA512

      d7e8fd60a612af09f76af29a663361697697622e8cab4ceeebc249da2e7e009f0f1e6ffacaba7b42124ced60dd80f69c6b69afb1873ae04f27b9e6918bfb26c1

    • SSDEEP

      768:lFx0XaIsnPRIa4fwJMaLWcOd3z3VdMprmKCdawhT2a:lf0Xvx3EMaLWltApmj0w4a

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks