General

  • Target

    SOR Price 062820KATARA PROJECT - MECH SOR (Tender).exe

  • Size

    598KB

  • Sample

    200630-39zgk69xee

  • MD5

    ee1301ef174dab2858125132404aa768

  • SHA1

    6f2fad9bd35f51576b8d07be4ce348a24bfd6fab

  • SHA256

    3cd7b7303d14fffed44e13ebfbd0a38fdbba39adc902ff5985d30f70ff2426f0

  • SHA512

    a7b0db150de8abc2b11e465536618863a0f864030529560460f2c6882832f248d7b3168b740c4eebf782ba7a1cb7982dfdfa7fc58a39f223b85a01b922b90e66

Malware Config

Extracted

Family

lokibot

C2

http://79.124.8.8/plesk-site-preview/chongelctricals.com/http/79.124.8.8/china/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      SOR Price 062820KATARA PROJECT - MECH SOR (Tender).exe

    • Size

      598KB

    • MD5

      ee1301ef174dab2858125132404aa768

    • SHA1

      6f2fad9bd35f51576b8d07be4ce348a24bfd6fab

    • SHA256

      3cd7b7303d14fffed44e13ebfbd0a38fdbba39adc902ff5985d30f70ff2426f0

    • SHA512

      a7b0db150de8abc2b11e465536618863a0f864030529560460f2c6882832f248d7b3168b740c4eebf782ba7a1cb7982dfdfa7fc58a39f223b85a01b922b90e66

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks