Overview

overview

10

Static

static

3

hab.exe

windows7-x64

10

hab.exe

windows10-2004-x64

10

hab.exe

windows7-x64

10

hab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44b7f1a0bbdab6175749184a630e7445b16eb0c9e6671c453aabce8f3ced5922

  • Size

    1.1MB

  • Sample

    240524-n4znxsgh6t

  • MD5

    6d82d3927b9b87282ed17b9df5477539

  • SHA1

    ebf81aa55cdb676ef7b5dcd0ec47188c641e93c4

  • SHA256

    44b7f1a0bbdab6175749184a630e7445b16eb0c9e6671c453aabce8f3ced5922

  • SHA512

    7666e617167801009e7ad11b8c926ae341dc08b6d2bb849ede1118eca583ef0f2881a7b0c3f59c079e78da9d40fb6401ecb1b502d8b6ff691c0ab34b8a9838b1

  • SSDEEP

    24576:G9x3C+HqUjAE3QWhqx7Z96qoi/9x3C+HqUjAE3QWhqx7Z96qoiF:G9x35H38CQR7ZKy9x35H38CQR7ZKW

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://tkanilux.com.ua/xy/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      hab.exe

    • Size

      802KB

    • MD5

      6fa59c037085c8f1d744da3f0bcf4404

    • SHA1

      99540076afe5478f0268f5cc35449b510b883fc2

    • SHA256

      adcf0b372228b76e987deecd0f45733e93dee3a798258546612a8f2232044d81

    • SHA512

      23f8d74f6483886f71a939f7ea36dcc476a95115e6d05db0e1fa657495dadd8864f7ff2a3849f8fa3849decd5d8e53e0fce8f0184a1f30bd9f914c1dce9b9f0d

    • SSDEEP

      12288:Cb6mCM9sXHh9BoRPqsxOVKuS5r70xwgeqh043L97/hO+mVvldcgcbqSw:7eSHhYRRxOVGcxJBdb1LwvOc

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      hab.exe

    • Size

      802KB

    • MD5

      6fa59c037085c8f1d744da3f0bcf4404

    • SHA1

      99540076afe5478f0268f5cc35449b510b883fc2

    • SHA256

      adcf0b372228b76e987deecd0f45733e93dee3a798258546612a8f2232044d81

    • SHA512

      23f8d74f6483886f71a939f7ea36dcc476a95115e6d05db0e1fa657495dadd8864f7ff2a3849f8fa3849decd5d8e53e0fce8f0184a1f30bd9f914c1dce9b9f0d

    • SSDEEP

      12288:Cb6mCM9sXHh9BoRPqsxOVKuS5r70xwgeqh043L97/hO+mVvldcgcbqSw:7eSHhYRRxOVGcxJBdb1LwvOc

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks