General

  • Target

    75a2f037e46961ac9e70ac8a8d52f06b4b20786ac7ac596abbb039c6a2715430.exe

  • Size

    608KB

  • Sample

    240821-b7pa5sxhmj

  • MD5

    82d01925b7ea7bbd4fc77c6240016c88

  • SHA1

    00051b965928e2126f02471edd8346b45fab1ef8

  • SHA256

    75a2f037e46961ac9e70ac8a8d52f06b4b20786ac7ac596abbb039c6a2715430

  • SHA512

    c99d961072ca151b7fdcf211982279378dc12149dd25aa232eb2e02e6a9c604e12c76242d6dfa669aa227946564798d2b7871b47cebdb72ca02c6339713c7935

  • SSDEEP

    12288:jlc1CwgqaVouy0PlTr7vyWkwr6rZhVuNQhcB4Eopf0EzWkR:jMC/qaSuyKP76WkQS/uNxxoZl

Malware Config

Extracted

Family

lokibot

C2

http://104.248.205.66/index.php/posts.php?8=1

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      75a2f037e46961ac9e70ac8a8d52f06b4b20786ac7ac596abbb039c6a2715430.exe

    • Size

      608KB

    • MD5

      82d01925b7ea7bbd4fc77c6240016c88

    • SHA1

      00051b965928e2126f02471edd8346b45fab1ef8

    • SHA256

      75a2f037e46961ac9e70ac8a8d52f06b4b20786ac7ac596abbb039c6a2715430

    • SHA512

      c99d961072ca151b7fdcf211982279378dc12149dd25aa232eb2e02e6a9c604e12c76242d6dfa669aa227946564798d2b7871b47cebdb72ca02c6339713c7935

    • SSDEEP

      12288:jlc1CwgqaVouy0PlTr7vyWkwr6rZhVuNQhcB4Eopf0EzWkR:jMC/qaSuyKP76WkQS/uNxxoZl

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks