Overview

overview

10

Static

static

3

HSIFsnN0YhuG0YQ.exe

windows7-x64

10

HSIFsnN0YhuG0YQ.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HSIFsnN0YhuG0YQ.exe

  • Size

    513KB

  • Sample

    230516-l6f89acc74

  • MD5

    18eac976314f6ac1e39e1a61297ec680

  • SHA1

    dcaff7f36c7092d849e2634dd26e8e5112386ddd

  • SHA256

    9cedcc423c89f58cdef6386a96d9d57237cc0ce9b84622651691ec7e40d1e128

  • SHA512

    c3472f6aedc128cb264bc279273f125e35baf09cf1d6e2a9fd2ec509fca5e116193c229f7d51e71db1dd9194023abf3e678690215ed4f3b6e14160b442cb171f

  • SSDEEP

    12288:2YSv5rd9ymDtS9yQIiNn8EUorDvTuffDVEQDVnBJoyZMNe:2jFDGyQDNn8EUo3vTuEQBBq2

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/zino/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      HSIFsnN0YhuG0YQ.exe

    • Size

      513KB

    • MD5

      18eac976314f6ac1e39e1a61297ec680

    • SHA1

      dcaff7f36c7092d849e2634dd26e8e5112386ddd

    • SHA256

      9cedcc423c89f58cdef6386a96d9d57237cc0ce9b84622651691ec7e40d1e128

    • SHA512

      c3472f6aedc128cb264bc279273f125e35baf09cf1d6e2a9fd2ec509fca5e116193c229f7d51e71db1dd9194023abf3e678690215ed4f3b6e14160b442cb171f

    • SSDEEP

      12288:2YSv5rd9ymDtS9yQIiNn8EUorDvTuffDVEQDVnBJoyZMNe:2jFDGyQDNn8EUo3vTuEQBBq2

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks