Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    tmp

  • Size

    313KB

  • Sample

    230717-nhkb4sbd76

  • MD5

    3e95261aa13150799f0146b58e080ec7

  • SHA1

    355bf29c3caaf40ad6db0b1c5d9556d5623b34d7

  • SHA256

    367f82b0aa68d1f0949ec9709ecdb4da28e5ef87c41b5de4c2edbad414631a6d

  • SHA512

    d54af4f97a95baa99e174ccc9f65b5cfa429d3f0ae3fd94c59a101945700f5c0d02ec4111ab05ff44565c2f3a244f0a4f6e5fd28ff8e9a64192a11e6b5f5a28b

  • SSDEEP

    3072:/TLAh4yEWMuqJA7pMp77E3Rzr4yGxHe5ybZ7OTiAT:rLAun6Uk6E3Jr4N1Jd7O2AT

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/mous/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      tmp

    • Size

      313KB

    • MD5

      3e95261aa13150799f0146b58e080ec7

    • SHA1

      355bf29c3caaf40ad6db0b1c5d9556d5623b34d7

    • SHA256

      367f82b0aa68d1f0949ec9709ecdb4da28e5ef87c41b5de4c2edbad414631a6d

    • SHA512

      d54af4f97a95baa99e174ccc9f65b5cfa429d3f0ae3fd94c59a101945700f5c0d02ec4111ab05ff44565c2f3a244f0a4f6e5fd28ff8e9a64192a11e6b5f5a28b

    • SSDEEP

      3072:/TLAh4yEWMuqJA7pMp77E3Rzr4yGxHe5ybZ7OTiAT:rLAun6Uk6E3Jr4N1Jd7O2AT

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks