Overview

overview

10

Static

static

3

202bb0c3e6...76.exe

windows7-x64

10

202bb0c3e6...76.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    56ba31bd6135e38fd2e9a997c16e1f7f85f77112e0d8a24569b1d401555fc54a

  • Size

    384KB

  • Sample

    240417-qyx91saa57

  • MD5

    6121fcaea4fe470909dd7c03e6749d14

  • SHA1

    2538950e5e38ba71dd94ebd853c26dea30131f41

  • SHA256

    56ba31bd6135e38fd2e9a997c16e1f7f85f77112e0d8a24569b1d401555fc54a

  • SHA512

    6ffa7301ea06b07d7bfbd379159ad1d98891be5d4e84662dde0b87be0af55c73a6e2cd8ee9c1e03604094e0cf52650c70a8e9e1acda3c4eaa4bd9809a6936c0f

  • SSDEEP

    6144:Jq7Bbf0+UQzLK56p6hXXD78BE0w3fM62zpgbpQJPRxCtPzFFd5ciY86AB9aVgMql:ULUUK56p6Zz7iE0wvM62VtWpfhGS46

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/c11/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      202bb0c3e66d81f1a6ae9445cb73a640eba568ae43f4078739829facfc6a4a76.exe

    • Size

      534KB

    • MD5

      4a2201003ea6bdfe56c4308d58e37443

    • SHA1

      899db1f1bcc4df37b06365a84502f897882d24ca

    • SHA256

      202bb0c3e66d81f1a6ae9445cb73a640eba568ae43f4078739829facfc6a4a76

    • SHA512

      6c7cddbd1f623a59b2ab674c53d908bdd6071fff5b068a6f40d0263936c680b42c2762fc0ff5e094476bffc65a0845dd4886dc560c0e87bc566de571280b2dfe

    • SSDEEP

      12288:MymXNjZLA2CtTfImso9/lcZb6SiABO+I4Nd:zttTHt863IO+z

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks