Overview

overview

10

Static

static

3

07c1a82c55...f7.exe

windows7-x64

10

07c1a82c55...f7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8d0e448bab94cbd8e0005979b1a33b4bec2677651a8d7cfde3b91fb5b738fed

  • Size

    335KB

  • Sample

    240417-qy6w6abf4y

  • MD5

    01e42e2f5490451abd604927c69d22a4

  • SHA1

    bbb6956de3a34c035ec4bada69c8e0ca1572a5d0

  • SHA256

    a8d0e448bab94cbd8e0005979b1a33b4bec2677651a8d7cfde3b91fb5b738fed

  • SHA512

    1be81736b8934265c75fb7490b09b7cb6d60dd5808172d6d376aea5feeb4aa16565f91a0b0eec0dae759d8755a75a2a1e654e06cef26847dd1ebdb0906354db5

  • SSDEEP

    6144:tIRJTDDeSGxHFEMiduYYnJT1gBdfBCr01X3hrdb6COUGmtSXg3/GRDs4n93bRZdp:teJTDD2fEMYs1cBwEhrd2Bz4SXi/qbdT

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/c11/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      07c1a82c5517f92f78a830e12cb1813430c4e02e02c1b6d16cd8d632f80d92f7.exe

    • Size

      431KB

    • MD5

      68894cfd6f4a1bfff344f54760726df7

    • SHA1

      9ae844e3abd601bf5daca1e3ebe331591388493e

    • SHA256

      07c1a82c5517f92f78a830e12cb1813430c4e02e02c1b6d16cd8d632f80d92f7

    • SHA512

      ecbff66abb82def82b0b51f24b0f9a58bee7f214ea83630c48ff0dd65a308e9ec54248e756948967729ecfd0d0c524a84e7230b3935cf8779160d491b6716797

    • SSDEEP

      6144:T+hiQ1o1W5UoKOy2Y5Dd1yh2gReb6d0VOw8qRBGEPU49ogCvrFbtKSyISGgEJFs:ifrKOeRch2g0zVf8qRkSU4+gOxlcHwF

    Score
    10/10
    lokibotspywarestealertrojancollection

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks