citadel

General

Target
68673e6a63aad0f8e9d315807085511f4abc170964fa6b5b7118be39ee586b6b
Size 1.1MB
Sample260202-x6c3daay3h
SHA256 68673e6a63aad0f8e9d315807085511f4abc170964fa6b5b7118be39ee586b6b
MD5 15a408bdc1a79f6c482353695bf2f5b6
SHA1 48d3037d81189f82b5841d8f0e4abbbefc7b2556
SHA512 1accdd2e205e4d04fef4604fece133cf2bf6a54b3c00fb5a23a19e59f248c0eb30fa205714b6224a6c06e449fd005b48aefd4127269d62e00038a1965d1ea790
SSDEEP 24576:lbCaf+u/a86PENwmzD3kOn+CMjmKlCTJtfrCdwRrWyx7EmgsT:lb9Sc/0OrYKtxDgsT
TLSH
T1A9453396B7455793C24ADE4CA385C0BAF13A9AB8543BC9A1D7FCC2027F053416639F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://evervisionicd.com/xquat/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  Commercial Invoice & PL - TWNYC3469342.scr
- Size 787KB
- SHA256 2b123fa8f08714a93a01db03bdf4ecd31d268d5d279900b9c67fec861c2bc11c
- MD5 cc41e556572c9bf5ba045f89198f7b98
- SHA1 47f2431463872774d27e3ce89999bc69b0fdab2f
- SHA512 72391718a6e316bf8e72a2f2dfb4b5d889034c2300307562d4548ef6be896632eb23f0203f69c2b93a01bdb154ce8ba2512b0bc4aa832acea028f6d283428525
- SSDEEP 12288:jExUfsAmpzpc+sK2gnnqovUVuqgQJV59m6jLDZK9BNX5TaMMPWmk44zfO5cCfkIJ:gGfM18WnMVuvk591jLtK9BN/pWefOb7
- TLSH
  T1DE05C062F6F04437C12316FD4C5B536C592ABE5139289A8F2BE4DD4CAF3B641392A2C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence ransomware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  HBL+MBL ETD 603 SO B498+499 (LCL FROM TAICHUNG TO LA).scr
- Size 731KB
- SHA256 b1153f4e9733d41d87b833d5104dd232438d396a2e51b326e2336e53b93bf382
- MD5 7d6336becada954a54a45adb18bd17f7
- SHA1 e232394fafee694f1d111d9ffa66b700eb3d5ff8
- SHA512 a8fd8eb6076f1a6dfd35385fa831f48210676ceb19baaf47aed04e09ba60a5c44d02cf249521e456cf10aac013a36af19aa925e09396189c79e41ba70f60fbc4
- SSDEEP 12288:aExUfsAmpzpc+sK2gnnqovUVuqgQJV59m6UDV/KPPCGWK5wsW0UfxvRW:rGfM18WnMVuvk591DLGFI
- TLSH
  T167F4BF32E6F01437C17316FD8D5BD66C6926BE513928A94E2BE41D4CAF3B781392A1C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

botnet discovery citadel persistence trojan
- Citadel
  Citadel is a trojan and botnet written in C.
  trojan botnet citadel
- Citadel family
  citadel
- Detects Citadel payload
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  SKM_C454e20040115221.scr
- Size 591KB
- SHA256 d404a04c648fc2966698a40775202d64e252e088aabcf0c447debbd3e347682f
- MD5 25ae9cf7afaa894cad8f4211d05bd372
- SHA1 ae8d747667ed5f8bc3df6df54c1b6bc85f2c76f2
- SHA512 a1f14a5419ccd480a182181cbab74b617e123570a7e1b16d1f2e5a7628c39281b928e7f150c4f663ddd80354999b344ecefbe7b38550368f3e01d00acc6132cf
- SSDEEP 12288:cExUfsAmpzpc+sK2gnnqovUVuqgQJV59m6zkHo14CotpK9o:dGfM18WnMVuvk591zkHo2CMP
- TLSH
  T196D49E22E6F05C33C12316FD4D5B5768592AFE51392999CE2BE41D4CAF3B681392B2C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Lokibot family
  lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral5 behavioral6