Overview

overview

10

Static

static

5

Purchase order.exe

windows7-x64

10

Purchase order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d2d1824e4a0e437359f4d36e50619bc71e1a65f9653cea734288c2ed780e027

  • Size

    500KB

  • Sample

    241126-ky692atqfz

  • MD5

    da70122fb62c26bda00355586c568e34

  • SHA1

    2f152c6f408875849391fa54766b53ab8f1d8152

  • SHA256

    3d2d1824e4a0e437359f4d36e50619bc71e1a65f9653cea734288c2ed780e027

  • SHA512

    a79e4ec82027878b7150b33e1c9d179730a15afdc3a980eef5fdb1035030c09c249ffbd2f66635eb331ae485fea11fd4493250216166cd43bc96bcb25b5888f6

  • SSDEEP

    12288:2xQXIovI8LbBR7Rkj8lMNdQ3BfEhSl81WYTZ4ttBL:2aXLvI8LbqQlMNd6NEga9Z4B

Score
10/10
lokibotcollectiondiscoveryspywarestealertrojanupx

Malware Config

Extracted

Family

lokibot

C2

http://94.156.177.41/davinci/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Purchase order.exe

    • Size

      525KB

    • MD5

      a5f52a9c799b36cb3b16726d05fa6331

    • SHA1

      ad6282f9ccd7517ff594e7ee1d3f878a0d055c51

    • SHA256

      4832a2cd8445cf94157ca3274a0ada513a2e7b875ee545f589d34859d9c8fbfe

    • SHA512

      f06b79e471f14b4b4b91f65e8a4e7d7763904cf59800f05e701abd6cdd31cb07d86ed0073eb92d2ca31c5ff9e25138697d68d454515a3fa4cdcde56a6ff4991b

    • SSDEEP

      12288:sOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiqXV1WYTbCntBmI:sq5TfcdHj4fmbNbCaI

    Score
    10/10
    lokibotcollectiondiscoveryspywarestealertrojanupx

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Lokibot family

      lokibot

    • Accesses Microsoft Outlook profiles

      collection

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks