Overview

overview

10

Static

static

10

d1ed72922a...a9.exe

windows10-2004-x64

10

d1ed72922a...a9.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VirusShare_b5a3cb742c0cc8585a3fd090b4485652.zip

  • Size

    51KB

  • Sample

    240802-tk599a1ajk

  • MD5

    9686060521e8cd9a5319e8e6330f05a4

  • SHA1

    5858aa05da6e9718f035da8a44671990f7668858

  • SHA256

    26ec8889be17f20897c654662e9143d0f987a2054f352b919d55d9769be14316

  • SHA512

    450e00aca9fb40b2f695ae6301f75d8ac35eb0cc8fe7a1f00f1841db7db6c2f202652ac0050bb3e10cb5be403f2e483e551466e0342fc88b5eae1732de07c84e

  • SSDEEP

    768:cNKVzZzQcP1XU0yvZku17oBrhQQtoe/YwCqIjSrwXK3ivqTvDWL0fR4EybB:LVlzb1XQb17oNBtj5CvGrwXOiv0KXbB

Score
10/10
lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://svit-zer.com/cjsettings/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      d1ed72922a3e987090ae3465ce27aa582e0101b0211780a0a796684a8f798da9

    • Size

      104KB

    • MD5

      b5a3cb742c0cc8585a3fd090b4485652

    • SHA1

      e602a85de0d186b8e740952e136cc8b33740d6b4

    • SHA256

      d1ed72922a3e987090ae3465ce27aa582e0101b0211780a0a796684a8f798da9

    • SHA512

      245dfa252dc6d8a57e5cd0f5825aba1b11006cc3ddf4f8e6bee6af5fbac46345666882d2a2af9229b27491aa930407b3ab13ecf3b7a0c810e1bd79f1627225a7

    • SSDEEP

      1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

    Score
    10/10
    lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks