Overview

overview

10

Static

static

3

6bedede89d...1d.exe

windows7-x64

10

6bedede89d...1d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3386773652cab6d42e5eb77f33b414c2.bin

  • Size

    501KB

  • Sample

    240604-bybcxshd39

  • MD5

    096b1ec102d4669e0f9d373c777029c0

  • SHA1

    fecbdd92bdbebb377c0c82ae8a7e064406afe39e

  • SHA256

    579b90e2ac3f15921d4a49998dd395645a8d0aab142d4765ca29f84be465840d

  • SHA512

    97ba60ec42d323b1875c5aa107b0d9ce93be493dcdb358bb3768a0a1da21e83403c5f2a4b6683f0c2785697f64c22ab0bfdf906baed7d9f058194386513b3917

  • SSDEEP

    12288:hRUPZ1hE4pocrlwbp+J/FH8vFRYgIbB5eyzkqsK/VLa/YaK:hRUPZ1CWY+J90FRy5pkqP+AaK

Score
10/10
lokibotcollectionexecutionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://namex-na.com/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d.exe

    • Size

      617KB

    • MD5

      3386773652cab6d42e5eb77f33b414c2

    • SHA1

      46af3a4f285a71a1f27b67e79359d980612226b4

    • SHA256

      6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d

    • SHA512

      cd6f3a152ae82ea19686f83d26eac06e888dfe753bb8fc863570a2a1a6db3b9c5fedf910b71e2d40886c07d650c4b35faf69c1f322560bc67539728b9aceb7c2

    • SSDEEP

      12288:l2iKVaUqdJS4Vo5pLRpHiANQ6elKQI64i55oc:Y+UgSckQ61Qd4iToc

    Score
    10/10
    lokibotcollectionexecutionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks