Overview

overview

10

Static

static

3

366c3e4f90...b3.exe

windows7-x64

10

366c3e4f90...b3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5dfac6cd827fa9639600a7f3bb1ee392259fb1fd6c57741c04b701703895ac8

  • Size

    424KB

  • Sample

    240417-qyy7babf31

  • MD5

    10c86b2a1eb684c3d8613245bd6eabdd

  • SHA1

    71e8a6f24e820a7a07147b31e94527dc5b9b8a04

  • SHA256

    b5dfac6cd827fa9639600a7f3bb1ee392259fb1fd6c57741c04b701703895ac8

  • SHA512

    4058f27feac0353ef9a9cbfe2888792af000f5a0083c72375dbbae386036c3be18d00d7d13c2db0be1b678cc01d5233189a0264c9191b462ae823f00db51cc0e

  • SSDEEP

    6144:Z7ic1XHaiZhgFDqBNSpMUwqCjSzhVpCJFTQNdw8TwqmM+2A71XK:Z7LqibgcCp5N8uq5Qvw8wdp5J6

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

https://mauricioclopatofsky.tel/user/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      366c3e4f90b97f849ae44a2d0f6c6d78b9dab71582e3fbeca225180b39d589b3.exe

    • Size

      483KB

    • MD5

      dbde6d96e328c169028b2673d4d89d27

    • SHA1

      d3991b143298c33c56300595cc5b8c9ae870675d

    • SHA256

      366c3e4f90b97f849ae44a2d0f6c6d78b9dab71582e3fbeca225180b39d589b3

    • SHA512

      e85c0ba365dbfa8447eb4f5c8bbac5d236811e952f8ab223248067b958ca32e4242df66c3cbe2a3c1cf015cd90249f36e4b884c850a760326a0dac0c7d333ece

    • SSDEEP

      12288:eTfGjfehmBjCtepTyqlf7cIm0XtTofGhqk1cS7EVw2XN:eTfGjsmBUoTRf7ZjtTdH1x7J2XN

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks