Overview

overview

10

Static

static

3

PO0987656789-000.exe

windows7-x64

10

PO0987656789-000.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dba1510d5df5fa7cb53171719e858ce0cb921f80fd674e6ae7ada0bc69e54708

  • Size

    517KB

  • Sample

    241121-p72hcs1hqd

  • MD5

    6d795ed331667f0e03c87a22509d6406

  • SHA1

    fa01b2b93ddaae57e10442cfb2a17ed4a9f1727a

  • SHA256

    dba1510d5df5fa7cb53171719e858ce0cb921f80fd674e6ae7ada0bc69e54708

  • SHA512

    0bb0dc4578165f52778745738d466e175c2f0c0f8db0f14ea947c17e0f7650b7ca89b2eb9f83e6e70a9230a4b75fe79ea3b2fe72d3453ee056bf16108c63592d

  • SSDEEP

    12288:SmvIv/suuRxoWgnEDKAKrj1XBXyBE/1YwgbRENJl9zN5ZVRmzb:SwIvUHRxo/8KpNXBCBE/ywTNl7ZVUH

Score
10/10
lokibotdiscoveryexecutionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://87.120.113.235/18/pin.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      PO0987656789-000.bat

    • Size

      601KB

    • MD5

      7dc14b5103c915796dc2f57c7ecf8773

    • SHA1

      9bc0108e3662c2659b143ccf83bb5bd129fd3d2b

    • SHA256

      b563b069ae09bfbed6d6139f06cd458c02efd33d8deb28db43ed68bc22965ad8

    • SHA512

      225a77729e5f88f1df0501670903f11c5b2c532e7dedecdb20349019124f5fd5b5c4cde282d98471b593f3fe9cba32f524279f4a0b695d3f2941614d36bd86f5

    • SSDEEP

      12288:NJ3wtfRzxWWkDIAcrWTQY19MPyBE/r/m/hwnAhowXNDlf/6IiAo4X:NJMpzxWHI509MqBE/jQwnABXNxZR

    Score
    10/10
    lokibotdiscoveryexecutionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Lokibot family

      lokibot

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks