Overview

overview

10

Static

static

5

9876567899.bat.exe

windows7-x64

10

9876567899.bat.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9876567899.bat.exe

  • Size

    1.1MB

  • Sample

    250107-l3zw7awndv

  • MD5

    6d9798801523ee1c8c5dc83d28346814

  • SHA1

    66d6c6e65ffb8c635a286d68de624ef5d469cf9b

  • SHA256

    62e0fac7c5231aa0d8d5f0fdb9e64d8bdadf79934a26577282b7affbc557a5fb

  • SHA512

    9dfc24338cee8dbbe830f4011d9b91fcaecbb861e75b19b9d28614f1d3b7d290da4c1146251a09cb66b0b9872e7bf12c6899ca8090d1292cc0c11e2e0e700164

  • SSDEEP

    24576:RqDEvCTbMWu7rQYlBQcBiT6rprG8ahmu9LHa7yyx:RTvC/MTQYxsWR7ahmiHaOy

Score
10/10
lokibotcollectiondiscoverypersistencespywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://172.245.123.11/tpm/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      9876567899.bat.exe

    • Size

      1.1MB

    • MD5

      6d9798801523ee1c8c5dc83d28346814

    • SHA1

      66d6c6e65ffb8c635a286d68de624ef5d469cf9b

    • SHA256

      62e0fac7c5231aa0d8d5f0fdb9e64d8bdadf79934a26577282b7affbc557a5fb

    • SHA512

      9dfc24338cee8dbbe830f4011d9b91fcaecbb861e75b19b9d28614f1d3b7d290da4c1146251a09cb66b0b9872e7bf12c6899ca8090d1292cc0c11e2e0e700164

    • SSDEEP

      24576:RqDEvCTbMWu7rQYlBQcBiT6rprG8ahmu9LHa7yyx:RTvC/MTQYxsWR7ahmiHaOy

    Score
    10/10
    lokibotcollectiondiscoveryspywarestealertrojanpersistence

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Lokibot family

      lokibot

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks