General

  • Target

    Quotation No Q240419617.exe

  • Size

    554KB

  • Sample

    240514-1kw5xahg3v

  • MD5

    8331118cac957fd6de499161580db764

  • SHA1

    944d3f2ed04a7213c5d6774932784e70fa268c26

  • SHA256

    a1dd7d24763249bcbf451a5c7e58b950e04f365757b627b57546ad80ac00c028

  • SHA512

    98d5e0e21a96a1eea2217fd60a997570444df51846776debf36eaa336b0bedb637544b43ced0b1b64f0b17a9eb51aa305be8a4609f2cae3d71e0355669d7ed3f

  • SSDEEP

    12288:05sAXYMjhvPie/rByY7777777777777eEQiRU0pxkoabc+VC1Y6ae2Rg:05sAXYMFniyys207PIc4CK60

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/d2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Quotation No Q240419617.exe

    • Size

      554KB

    • MD5

      8331118cac957fd6de499161580db764

    • SHA1

      944d3f2ed04a7213c5d6774932784e70fa268c26

    • SHA256

      a1dd7d24763249bcbf451a5c7e58b950e04f365757b627b57546ad80ac00c028

    • SHA512

      98d5e0e21a96a1eea2217fd60a997570444df51846776debf36eaa336b0bedb637544b43ced0b1b64f0b17a9eb51aa305be8a4609f2cae3d71e0355669d7ed3f

    • SSDEEP

      12288:05sAXYMjhvPie/rByY7777777777777eEQiRU0pxkoabc+VC1Y6ae2Rg:05sAXYMFniyys207PIc4CK60

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks