Overview

overview

10

Static

static

1

Order Form.rtf

windows7-x64

10

Order Form.rtf

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    Order Form.doc

  • Size

    30KB

  • Sample

    230505-n6bd4sab88

  • MD5

    2748c85909566facdb25450a5db5daa7

  • SHA1

    26083397c80de658c19bc2cbfd7c80932beaaf24

  • SHA256

    2fcbc1f021fb7e5eeae01012e094f0c99d4699f893fd07a511edae7f844f7803

  • SHA512

    35adef43550385aa8ccdb7ae6a1456786c4953576c7bb57002269367123b909c0b70cd86ea8e08a27ed8877dbd01fbd8a3f303998225efaadc7f11907dae17bd

  • SSDEEP

    768:GFx0XaIsnPRIa4fwJMvLB0MMkgvgOyO2ZxJ:Gf0Xvx3EMvLSMMkgvWOS

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/donpy/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Order Form.doc

    • Size

      30KB

    • MD5

      2748c85909566facdb25450a5db5daa7

    • SHA1

      26083397c80de658c19bc2cbfd7c80932beaaf24

    • SHA256

      2fcbc1f021fb7e5eeae01012e094f0c99d4699f893fd07a511edae7f844f7803

    • SHA512

      35adef43550385aa8ccdb7ae6a1456786c4953576c7bb57002269367123b909c0b70cd86ea8e08a27ed8877dbd01fbd8a3f303998225efaadc7f11907dae17bd

    • SSDEEP

      768:GFx0XaIsnPRIa4fwJMvLB0MMkgvgOyO2ZxJ:Gf0Xvx3EMvLSMMkgvWOS

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks