Overview

overview

10

Static

static

3

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d48a2b8410a53d0f6475fa8f93ef357ab2fbfe21a9b56af60ac3aa73cd4c1078

  • Size

    319KB

  • Sample

    230510-jxs6cagh2t

  • MD5

    6ade942d85d1738a7d52360ca1d34080

  • SHA1

    259fdeb6f82d0720d23d5b37b9f03d0bb7474a6f

  • SHA256

    d48a2b8410a53d0f6475fa8f93ef357ab2fbfe21a9b56af60ac3aa73cd4c1078

  • SHA512

    362601cc669fd23210c05a73274ee0c6d5b1f1fc797dec66b567526727cc78de40b001e6db696c8e19645598673c14b513564b90d3a8b00c9ed97898f85f697c

  • SSDEEP

    6144:7AlTLATq+/lVkvYIfTWVKAag6K5vIV6DvGG4+:7q0Tq+xWaVK7OIVQvG

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://208.67.105.148/ok/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      d48a2b8410a53d0f6475fa8f93ef357ab2fbfe21a9b56af60ac3aa73cd4c1078

    • Size

      319KB

    • MD5

      6ade942d85d1738a7d52360ca1d34080

    • SHA1

      259fdeb6f82d0720d23d5b37b9f03d0bb7474a6f

    • SHA256

      d48a2b8410a53d0f6475fa8f93ef357ab2fbfe21a9b56af60ac3aa73cd4c1078

    • SHA512

      362601cc669fd23210c05a73274ee0c6d5b1f1fc797dec66b567526727cc78de40b001e6db696c8e19645598673c14b513564b90d3a8b00c9ed97898f85f697c

    • SSDEEP

      6144:7AlTLATq+/lVkvYIfTWVKAag6K5vIV6DvGG4+:7q0Tq+xWaVK7OIVQvG

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks