Overview

overview

10

Static

static

1

Formular_d...92.exe

windows7-x64

10

Formular_d...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10072024_0120_09072024_Formular_de_rambursare_202400090704892.tar

  • Size

    605KB

  • Sample

    240710-bqf87sxflm

  • MD5

    a4c5b9024d64fd08f6c2cb9579a59f6b

  • SHA1

    be001ea8f760b682c5be3e0b72240ebf3d12b774

  • SHA256

    60027c93d4bc75cbdbb98244a220b8ae466facb244f382edaf5e229aaab0ec34

  • SHA512

    f01e0e00df9bfb59eabe75ee98b6ab51e6ad1e2ac8a75a4005f24a4cc64f511a1e49afe5c876bce3a18c5eaa14e1c4487a8cbe91f440b2cff66ea8d8fa4e57c5

  • SSDEEP

    12288:0+y1gxXGRnqw3+dMdBVgKY3JI7HyCrK8DbT1iB6Swx4So4fXgbT:hxo9udMdElC7HrrpD6egbT

Score
10/10
lokibotcollectionexecutionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://104.248.205.66/index.php/61226985438917786

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Formular_de_rambursare_202400090704892.cmd

    • Size

      867KB

    • MD5

      1dc5f66bc079586ec34caa1539e9a3c1

    • SHA1

      da62edb620350c10918998b0cb2172b3733a8f5d

    • SHA256

      4785d17feedabdb54660fcda356392d29749d4fb8130667e68d48c75735f418a

    • SHA512

      66032b4d205d05d01f5ee87eccc53c65357003ee61c97677f8cf126e07829ce5b31cb4892f27a0de19498a03c3f22ad6b72e093261e4315fcd527fcd5c1a9fb3

    • SSDEEP

      24576:4HEN1Fdrt0ZpKjKQ5ROdq+CztpBbFsRwI:4SRrKaX5ROdq+0zsF

    Score
    10/10
    lokibotcollectionexecutionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks