Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

-Invoice.exe

windows7-x64

10

-Invoice.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    -Invoice.zip

  • Size

    260KB

  • Sample

    230419-kkanxabc3t

  • MD5

    ab3472da2765a4150a9410297ae1ac9c

  • SHA1

    7b8c57fdee7c32bc07e93ff55a4f10039c746c76

  • SHA256

    65e3c180f76643587a2bcf7a1703597afadae0a9170521d8c2493a8cf0caf66c

  • SHA512

    1d97d7bff988f9d16d88297fcfc99ab8a47b38b5517d01bda189d6bbf368062357680ad7aa73a51fc3459f7c850fa2ce58f3a96733a389f01620bce386e0583c

  • SSDEEP

    6144:DpU8PLrQkOZZMg19ynVjqYkhQVGX5oOYT5ppiE1pY4i:5PLrv64nVjq5JcT5XpYp

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://185.246.220.60/project/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      -Invoice.exe

    • Size

      274KB

    • MD5

      58140a0133fb3e9fdea86ce4f486a525

    • SHA1

      cc8d7dcbcac7d663208a0c55c6cb1b3721697b9b

    • SHA256

      db4039e00a0a08bf2da23a2eb516c83da306ff3f25d266a49fcead9779b1fbcd

    • SHA512

      b77b5308000570f290d5389b35af6e060cad0bc9cf4048c877c4ad92c5b0a83b9870a6519eced52e2682094ee9568c3829043019b5827fe57ae12751e4b0041c

    • SSDEEP

      6144:vYa6PH+xUOZ/MgTVynP9qYYhQBGX5oS+T5JpiY1pYxQ:vY1HAUQwnP9qNJYT5JpYy

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks