Overview

overview

10

Static

static

3

견적 사양서.scr

windows7-x64

10

견적 사양서.scr

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    28032024_2129_28032024_견적 사양서.rar

  • Size

    289KB

  • Sample

    240328-qrpz3agd45

  • MD5

    f3087a4cef94a6eaf9e9c0cfeadc4218

  • SHA1

    0f22153710a416a1700e53dcc74fc39ec5a81f2f

  • SHA256

    13abe3a68449adfe70b9c71c40af6f34d0d5f252b9ec4f7f97ef9b6f4d4634b2

  • SHA512

    c20e1713a13c3f0ff1d4577361a00bbe67d257bd51075c64cf5e507eb92502572338d6037ffe33c5dabbd168f79ac6ca02ef8e6474d04030ebfaba12d501e630

  • SSDEEP

    6144:jNjCiuV92e+ctzKrxbBL3cWk+I+LPb7aTGupkPbh:6f25CzKlbBL3cWknQ7mpk1

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://meridianresourcellc.top/document/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      견적 사양서.scr

    • Size

      332KB

    • MD5

      89f7e752cb6dbeb5fdfe82a67df3a9bc

    • SHA1

      249a25d0f254b074f8fcba656512a8f4a6101552

    • SHA256

      3d83a42c7406a8805e6293230a4fcdfabbf740dcb2d5a1bbea4015e6893450bb

    • SHA512

      f9da3e83577828e85930b1551022adb4f3dec5e51e22d84602cd542e59456ea3e98b317ac137b9d010f4fe8b9aef60fd13b592265ebd7a6e298db6145411eacb

    • SSDEEP

      6144:x38aRUwl6wrlMawpfDkCLNObM/hGBYWv3XZIxUY812jk7NguDRO:xH+wjRaNObM/svXe/8CvAs

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks