Overview

overview

10

Static

static

1

12f0fb53c3...a9.exe

windows7-x64

10

12f0fb53c3...a9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7136d5ef915e39c6d57f457739108890a3759d3826fe24e60e10c13a2b966fdd

  • Size

    538KB

  • Sample

    240518-j9nfmabe7s

  • MD5

    1ae0597983baafaa0369648c615c325d

  • SHA1

    ffe9b2afc62c90e95b0fa6118857431570c346ce

  • SHA256

    7136d5ef915e39c6d57f457739108890a3759d3826fe24e60e10c13a2b966fdd

  • SHA512

    12e3bc10ef89a807cb73170896643d2b04c26a89337de51df9de89efd4dc8aca3fafd36a82e437c41d4a4b17a623bb56129480674d17110e2de54d6bbcaf8c52

  • SSDEEP

    12288:YDjVmEBo65t9lJiWBEgUsfqgJS/19f7o1IzTFwdW4:YdZBdJ4gUsSgQdRzTFO3

Score
10/10
lokibotcollectionexecutionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://rocheholding.top/evie3/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      12f0fb53c3eda4a327523a3ad52ebfea151b7b3d88523c8624905af43ea781a9.exe

    • Size

      589KB

    • MD5

      aab1d3c0633ee5a766395a51c4b4cf66

    • SHA1

      30ff72fe2d42c22c85ff64d761b0a90f385fb0de

    • SHA256

      12f0fb53c3eda4a327523a3ad52ebfea151b7b3d88523c8624905af43ea781a9

    • SHA512

      38668792bb0c9ae16c3dedbe07ef744b43bc8784472a40eda1e803789c705e8fb765f01766e54ff4ba90c56f28c30ee30e72783223bb7fc8b432a857419e3ff4

    • SSDEEP

      12288:cu0pei36RfpKX2KnlNkgkbZne+G4jKvWy5OfQ3FXVvTI4nqvqskR:chpp36lpKX2alN+bh75evWy5OfkTI8qg

    Score
    10/10
    lokibotcollectionexecutionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks