Overview

overview

10

Static

static

3

2025-02-07...id.exe

windows7-x64

10

2025-02-07...id.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-02-07_8d7e901ce33cd45306deb615cf65e47e_icedid

  • Size

    704KB

  • Sample

    250207-da9xpawkhw

  • MD5

    8d7e901ce33cd45306deb615cf65e47e

  • SHA1

    dee0c4ae89def706920545c65329fd8ed9ec1288

  • SHA256

    6773eb0fd0ed03747c434853b0549a7e7301d4d75f4228d7abff3c01d139448f

  • SHA512

    3029d81b05907b38af4e73ed1e5b73bffaa01715aaa67e9a527f193d4a41fb1f3975d5794d0da70285f4b1b1c5db0aa0a59b04588c35a8dbd685555b6e6f0401

  • SSDEEP

    12288:wxJeeS0UD/dQw5wq9azAuQQs0M834q+sV4JG:wy/TdQw559azGQAw

Score
10/10
lokibotcollectiondiscoveryspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://onlygoodman.com/his/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      2025-02-07_8d7e901ce33cd45306deb615cf65e47e_icedid

    • Size

      704KB

    • MD5

      8d7e901ce33cd45306deb615cf65e47e

    • SHA1

      dee0c4ae89def706920545c65329fd8ed9ec1288

    • SHA256

      6773eb0fd0ed03747c434853b0549a7e7301d4d75f4228d7abff3c01d139448f

    • SHA512

      3029d81b05907b38af4e73ed1e5b73bffaa01715aaa67e9a527f193d4a41fb1f3975d5794d0da70285f4b1b1c5db0aa0a59b04588c35a8dbd685555b6e6f0401

    • SSDEEP

      12288:wxJeeS0UD/dQw5wq9azAuQQs0M834q+sV4JG:wy/TdQw559azGQAw

    Score
    10/10
    lokibotcollectiondiscoveryspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Lokibot family

      lokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks