SHARE
TWEET

#lokibot_281118-2

VRad Nov 29th, 2018 (edited) 155 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #IOC #OptiData #VR #lokibot #DOC #OLE
  2.  
  3. https://pastebin.com/W0e6iWnc
  4.  
  5. previous_contact:
  6. 28/11/18    https://pastebin.com/4hf0UEqM
  7. 16/10/18    https://pastebin.com/LPqjHUkQ
  8. 8/10/18     https://pastebin.com/cZxQGbyq
  9. 27/09/18    https://pastebin.com/5bpk5kKs
  10.  
  11. FAQ:
  12. https://radetskiy.wordpress.com/?s=lokibot
  13.  
  14. attack_vector
  15. --------------
  16. email > attach doc > ole > %tmp%\_output62EE4B0.exe
  17.  
  18. email_headers
  19. --------------
  20. Received: from hunimo.com ([165.227.74.204])
  21.     for <user0@victim1.com>; Wed, 28 Nov 2018 13:16:20 +0200 (EET)
  22.     (envelope-from Kathylin@gmail.com)
  23. Received: from [102.165.37.52]
  24.     by hunimo.com with esmtpa (Exim 4.84_2)
  25.     (envelope-from <Kathylin@gmail.com>)
  26. Subject: Payment Advice
  27. To: Recipients <Kathylin@gmail.com>
  28. From: "Kathy Li" <Kathylin@gmail.com>
  29. Date: Wed, 28 Nov 2018 03:14:42 -0800
  30.  
  31. files
  32. --------------
  33. SHA-256 448ff93c63401441c0a78b0ba8d61bcb89eafc5c000a5c13b8d943f1509170ad
  34. File name   INV001.doc      [Microsoft Word 2007+]
  35. File size   272.18 KB
  36.  
  37. SHA-256 cbc2cab2c86ff5d0de8e8c11315571ebba0f21d328b3bc9d6921f2b88b969edf
  38. File name   _output62EE4B0.exe  [PE32 executable (GUI) Intel 80386, for MS Windows]
  39. File size   1004 KB
  40.  
  41. activity
  42. **************
  43.  
  44. netwrk
  45. --------------
  46. 69.90.161.175   paylesssignandprinters{.} ca    POST /lordboys/panel/fre.php    Mozilla/4.08 (Charon; Inferno)
  47.  
  48. comp
  49. --------------
  50. [System]    69.90.161.175   80  TIME_WAIT
  51.  
  52. proc
  53. --------------
  54. "C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" /n /dde
  55. "C:\tmp\_output62EE4B0.exe"
  56. C:\tmp\_output62EE4B0.exe"
  57.  
  58. persist
  59. --------------
  60. n/a
  61.  
  62. drop
  63. --------------
  64. C:\Users\operator\AppData\Roaming\39B01F\FA74A3.exe
  65. C:\Users\operator\AppData\Roaming\39B01F\FA74A3.hdb
  66.  
  67. # # #
  68. doc     https://www.virustotal.com/#/file/448ff93c63401441c0a78b0ba8d61bcb89eafc5c000a5c13b8d943f1509170ad/details 
  69.  
  70. exe     https://www.virustotal.com/#/file/cbc2cab2c86ff5d0de8e8c11315571ebba0f21d328b3bc9d6921f2b88b969edf/details
  71.         https://analyze.intezer.com/#/analyses/08be5edd-c813-453c-9667-7f64bdb95e2d    
  72.  
  73. VR
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Top