Overview

overview

10

Static

static

3

Request fo...mg.exe

windows7-x64

10

Request fo...mg.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Request for Quotation RFQ 0036-2024 Commercial Proposal 2024 07 15.001.img.cab.zip

  • Size

    458KB

  • Sample

    240729-jeng5sydql

  • MD5

    606e20b6e89b1d6d0b99f34b8f5b23c2

  • SHA1

    e46132d335c8666f8be5bec32af138127a97bad8

  • SHA256

    e7bb4f6507f537c244207370092d25866dec63af3a771467b137a16495017be7

  • SHA512

    cfd2691cffb6813f162f030eb35b108bfbec8928bb8e77f4f76e596312fea4b7f00611d4d68ab80573abaecd4945d5c7664e2ede431e7a5225f636a67d3c2cdc

  • SSDEEP

    12288:UjQeFmog5UPD3oXee/3Bwwx7fsMZ4os3ZYbx:0QTXX62U84oekx

Score
10/10
lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://serak.top/ugopounds/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Request for Quotation RFQ 0036-2024 Commercial Proposal 2024 07 15.001.img.exe

    • Size

      995KB

    • MD5

      cfe05392605f333a1ed9abc7fe992635

    • SHA1

      60e56713191a5ff83cc905debd5a76c80fcd77de

    • SHA256

      38ab1533c224b90043299dc9b2a42bf456d0521de6d89a8eeb44336771943c3f

    • SHA512

      7b0e1ba85bbea3ed3e8dc46f265c8b517bec6639e1777e2ebde4e6b336cb547a45c3e01b093d73714df253f45aab7d1635ac213a2bd1f14f70f37fa94e1de96e

    • SSDEEP

      12288:rmeFmKg5mPN3ohe4/35ww17fsur4o23ZY19Uc:uJhXyaUy4og4Kc

    Score
    10/10
    lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks