Overview

overview

10

Static

static

7

MalwareBazaar.exe

windows7-x64

7

MalwareBazaar.exe

windows10-2004-x64

10

Resubmissions

25-07-2024 17:09

240725-vpjsgstanm 10

25-07-2024 17:06

240725-vmp7gsshnn 10

25-07-2024 17:05

240725-vlyggashkj 7

25-07-2024 17:00

240725-vjf5eawdle 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MalwareBazaar.1

  • Size

    583KB

  • Sample

    240725-vmp7gsshnn

  • MD5

    e44f18c0c7c0ef5103adb70ea9797794

  • SHA1

    e96882549e5ca1bc3cbedf276a3b0dc2e74b7c1c

  • SHA256

    ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d

  • SHA512

    3facc779735f5132569dd413191add13333a28d476c9adf3119773af3f6f5a36f1a5a1f768bb2c40c563c10c6574a4556a97755ec36eacb8e5d471341a067277

  • SSDEEP

    12288:LsHzOUNUSB/o5LsI1uwajJ5yvv1l2WmynaFDoml:6iUmSB/o5d1ubcvnA5oo

Score
10/10
lokibotcollectioncredential_accessdiscoveryspywarestealertrojanupx

Malware Config

Extracted

Family

lokibot

C2

http://45.61.136.20/index.php/jlbcyg0q595vs4hef0

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      MalwareBazaar.1

    • Size

      583KB

    • MD5

      e44f18c0c7c0ef5103adb70ea9797794

    • SHA1

      e96882549e5ca1bc3cbedf276a3b0dc2e74b7c1c

    • SHA256

      ce03ff47b601e4154e103927e9b8e9f9f54f18653fe4bebf0a25f6458009dc0d

    • SHA512

      3facc779735f5132569dd413191add13333a28d476c9adf3119773af3f6f5a36f1a5a1f768bb2c40c563c10c6574a4556a97755ec36eacb8e5d471341a067277

    • SSDEEP

      12288:LsHzOUNUSB/o5LsI1uwajJ5yvv1l2WmynaFDoml:6iUmSB/o5d1ubcvnA5oo

    Score
    10/10
    discoveryupxlokibotcollectioncredential_accessspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses Microsoft Outlook profiles

      collection

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks