Overview

overview

10

Static

static

3

dd1bf62f5b...7e.exe

windows7-x64

1

dd1bf62f5b...7e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe.zip

  • Size

    478KB

  • Sample

    231031-rff4fsbd82

  • MD5

    47f95fbcbdc2f648ee2dbe1af34b8fad

  • SHA1

    0774ae727d5e40cd96368c638a236183a68002b0

  • SHA256

    b65ce1ee7322dba6d7ccab24f907b5c94d0448a23a1110db597a39135c8d977d

  • SHA512

    8585266e6b26c6c1f4770f0d2987271dc161c1872c7138e9746c17daa5d0fbf48522d21eca2c116d3ff8a305b4d0b0321805951b147662aeaa5f69719ae8a8e6

  • SSDEEP

    12288:Y3I9JoaUcnrKaBnBY3qWo6r6Y5GTk1uy++8B:Y3PaU2BO6BmxK

Score
10/10
lokibotspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://216.128.145.196/~wellseconds/?p=817152758105

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e.exe

    • Size

      598KB

    • MD5

      aa504fa4dc0c6c5fb21aeda36579a853

    • SHA1

      3e9b482c60e579d0edc2ea6e518cc82a509eacb3

    • SHA256

      dd1bf62f5b51b9f2ae99cf1c33f19164c824ee43892bb9c7bf844f9be0cf977e

    • SHA512

      49e882e82297aaeee133b5bea2db83bfc16dd5bfcf46038fe41ee0a2dd4d597e6c4086f764bf8e9a69374660fffb077c21a498af209dfc292e21d1dd9b35ab6e

    • SSDEEP

      12288:b5MYGFGbdEE5wr17nlcAo7Y3hNXYEQXDu+EUuowWLCPV:b6dFKdw1DGY3wXK4wWLC

    Score
    10/10
    lokibotspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks