Overview

overview

10

Static

static

3

02ea28c9f5...df.exe

windows7-x64

10

02ea28c9f5...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75e30539d6bad3ff1870939605ae481fb602ae69cbfcafb110e67546c6a2c4d0

  • Size

    323KB

  • Sample

    240417-qpnn8ahd57

  • MD5

    71fee3614023e0f59c56ab79de550d42

  • SHA1

    8eab6f30b999aa7a0041cd14aed5ac6393069aaf

  • SHA256

    75e30539d6bad3ff1870939605ae481fb602ae69cbfcafb110e67546c6a2c4d0

  • SHA512

    b0ab30acee78f5e771b1f9ff30760b0f89f88a9ea1f1f4f03b21f7a7a6f7b193a2ab44e17adee70aa95d8b87e8f168328bbe801c525fc8c525d2ea9415f1191b

  • SSDEEP

    6144:SJwZ9+mXDJr+O71vaEtNrQgWGCeMmj3DUOKuIJb76MYU/Pg:SJwymTV+O1vaErrQN9eMmz87kKg

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://94.156.66.115:4012/dolul/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      02ea28c9f5235459c53d45468f9879bda1d10fc8c29ed70dfa3e4b8381d7bfdf.exe

    • Size

      355KB

    • MD5

      d4219524fa5d1c059e146919df74ebf9

    • SHA1

      8848795f07179b18cd39608c6548ae03fd25784b

    • SHA256

      02ea28c9f5235459c53d45468f9879bda1d10fc8c29ed70dfa3e4b8381d7bfdf

    • SHA512

      7fc36235daafeb5c5fe9e831dbc0d519bb01f577028079cf25bc33a96feb1923b222d4a57fc04cd385b3ee5554679321ebb75973711691b71b51c7c9791d2db2

    • SSDEEP

      6144:Lswns3s9/9x5DxUby36xOeFt1n2bnI20uZZsxbZz0VJCfIyzKYwOKVFbPm0DKrVI:LswnF8s6xOo/anEKZsL0ufIyztwOKVFD

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks