Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    payment advice for 114,999usd.exe

  • Size

    654KB

  • Sample

    230710-lp49rahf82

  • MD5

    f2f97546bca644b3456bcb209c91afb2

  • SHA1

    272911f4de0b07a8f65806e5b4370a0f7f8a68fa

  • SHA256

    2c3d16e1c28e192249da7fc79bc4fc2ed1508610627e82ca96c50083f4e0d9ed

  • SHA512

    63929ce5339d5e4701cbaff6ad41652023ea8002a54c0cc1561de2df5884f38dce1a788bc78da86052c7abd07d45fef91817a086d4f466e7fc2245e12fa2f241

  • SSDEEP

    12288:8J4a6p7tL+NLLTQmnW35MP2po2pi8s3YAZOFbwtsbdCYANPfu17ToE:Lp54TJna5MOwZwwtOAN8

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/fresh/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      payment advice for 114,999usd.exe

    • Size

      654KB

    • MD5

      f2f97546bca644b3456bcb209c91afb2

    • SHA1

      272911f4de0b07a8f65806e5b4370a0f7f8a68fa

    • SHA256

      2c3d16e1c28e192249da7fc79bc4fc2ed1508610627e82ca96c50083f4e0d9ed

    • SHA512

      63929ce5339d5e4701cbaff6ad41652023ea8002a54c0cc1561de2df5884f38dce1a788bc78da86052c7abd07d45fef91817a086d4f466e7fc2245e12fa2f241

    • SSDEEP

      12288:8J4a6p7tL+NLLTQmnW35MP2po2pi8s3YAZOFbwtsbdCYANPfu17ToE:Lp54TJna5MOwZwwtOAN8

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks