General

  • Target

    LisectAVT_2403002A_406.exe

  • Size

    1.1MB

  • Sample

    240725-at4y1azdma

  • MD5

    da2dd76b31a45ea2b9f54e9a7ff22f79

  • SHA1

    d674ed49f4be14b16abe7b71b96927288740309e

  • SHA256

    00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974

  • SHA512

    c5f25453068d7bff4af855873b59b95db69dc456d9a38c5cddba07eb95c9a2a58d98bb391d823cc9b41c8aaae15234a2baac642202c44a96c41c7683ede89178

  • SSDEEP

    24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8aLF/IcUuJ94fdFc:oTvC/MTQYxsWR7aLFRUuiF

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/c3/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      LisectAVT_2403002A_406.exe

    • Size

      1.1MB

    • MD5

      da2dd76b31a45ea2b9f54e9a7ff22f79

    • SHA1

      d674ed49f4be14b16abe7b71b96927288740309e

    • SHA256

      00ac69740d27d7d7304331fe6523983ac267a94a17d670bd9ef5b8b745148974

    • SHA512

      c5f25453068d7bff4af855873b59b95db69dc456d9a38c5cddba07eb95c9a2a58d98bb391d823cc9b41c8aaae15234a2baac642202c44a96c41c7683ede89178

    • SSDEEP

      24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8aLF/IcUuJ94fdFc:oTvC/MTQYxsWR7aLFRUuiF

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks