Overview

overview

10

Static

static

5

475605b7be...12.exe

windows7-x64

10

475605b7be...12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4fe39a6ca43136c5f3a422bccdf0648ddb6254364a41600e5157270e8f62dbf8

  • Size

    499KB

  • Sample

    240417-rq31zabg48

  • MD5

    13da592c0f39e1bd162992c91fdb5e3c

  • SHA1

    b751f7776ec4b9c06bc6b03dcbd56555286d9c79

  • SHA256

    4fe39a6ca43136c5f3a422bccdf0648ddb6254364a41600e5157270e8f62dbf8

  • SHA512

    88ccf57ad5005a2fc43d9303c6bff98241ac6fe2989e259c9f423e2fa471571129f339a37ff938cc25aac9bf831060b139552b85c630bb1c7d162d5926242ca9

  • SSDEEP

    12288:EIifpm9z8DDqaDn34JdTRrudeOpFMWZ8D1oaeAz9bGKk:jiw3TstZ8B/pzcb

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://ebnsina.top/kelvin/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      475605b7bec0b5c75c6e2592fd3484c2355c7d20070efdf29bb3091270f3e512.exe

    • Size

      927KB

    • MD5

      9d75b956b1aaaa9f0bbb13cb760f7494

    • SHA1

      612f4c7d0d30d1c9250a5bfaaade25f950f5012e

    • SHA256

      475605b7bec0b5c75c6e2592fd3484c2355c7d20070efdf29bb3091270f3e512

    • SHA512

      46d59a1daeabc0942ab1365d772e95d28a09e6d71fd42e76daf5073f125e633b0764a5ec328c6591e2ded4d8bdcc2c806fc3fb3707d34b33f7cb25e7f0fc20ff

    • SSDEEP

      12288:ghkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a1yUz4qVqcVWYh/e+Wf:oRmJkcoQricOIQxiZY1ia17cqV1teZ

    Score
    10/10
    lokibotcollectionspywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks