General

  • Target

    aab1d3c0633ee5a766395a51c4b4cf66.bin

  • Size

    538KB

  • Sample

    240518-de6qtsha57

  • MD5

    1ae0597983baafaa0369648c615c325d

  • SHA1

    ffe9b2afc62c90e95b0fa6118857431570c346ce

  • SHA256

    7136d5ef915e39c6d57f457739108890a3759d3826fe24e60e10c13a2b966fdd

  • SHA512

    12e3bc10ef89a807cb73170896643d2b04c26a89337de51df9de89efd4dc8aca3fafd36a82e437c41d4a4b17a623bb56129480674d17110e2de54d6bbcaf8c52

  • SSDEEP

    12288:YDjVmEBo65t9lJiWBEgUsfqgJS/19f7o1IzTFwdW4:YdZBdJ4gUsSgQdRzTFO3

Malware Config

Extracted

Family

lokibot

C2

http://rocheholding.top/evie3/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      12f0fb53c3eda4a327523a3ad52ebfea151b7b3d88523c8624905af43ea781a9.exe

    • Size

      589KB

    • MD5

      aab1d3c0633ee5a766395a51c4b4cf66

    • SHA1

      30ff72fe2d42c22c85ff64d761b0a90f385fb0de

    • SHA256

      12f0fb53c3eda4a327523a3ad52ebfea151b7b3d88523c8624905af43ea781a9

    • SHA512

      38668792bb0c9ae16c3dedbe07ef744b43bc8784472a40eda1e803789c705e8fb765f01766e54ff4ba90c56f28c30ee30e72783223bb7fc8b432a857419e3ff4

    • SSDEEP

      12288:cu0pei36RfpKX2KnlNkgkbZne+G4jKvWy5OfQ3FXVvTI4nqvqskR:chpp36lpKX2alN+bh75evWy5OfkTI8qg

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks