General

  • Target

    cdbb658f897d454ca8c7a8a71da0b51f36f679f913814f514d6d4b5de6a29004.exe

  • Size

    603KB

  • Sample

    200708-e5p5eh4fxs

  • MD5

    c19c75a75eab426252e73fe5b6afd05d

  • SHA1

    1354bd55828a9e0be1bd906a30de51e1314243fb

  • SHA256

    cdbb658f897d454ca8c7a8a71da0b51f36f679f913814f514d6d4b5de6a29004

  • SHA512

    e8b2d70817e9da01faabcf67f34964f13d609a43926d4542f14dfd0a3d4fbc27a3cc8e024177cf5c96fed8052d1e2b1a3aeaf5e81243777d8bbb08689330a067

Malware Config

Extracted

Family

lokibot

C2

http://rostovafile.ga/Colba2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      cdbb658f897d454ca8c7a8a71da0b51f36f679f913814f514d6d4b5de6a29004.exe

    • Size

      603KB

    • MD5

      c19c75a75eab426252e73fe5b6afd05d

    • SHA1

      1354bd55828a9e0be1bd906a30de51e1314243fb

    • SHA256

      cdbb658f897d454ca8c7a8a71da0b51f36f679f913814f514d6d4b5de6a29004

    • SHA512

      e8b2d70817e9da01faabcf67f34964f13d609a43926d4542f14dfd0a3d4fbc27a3cc8e024177cf5c96fed8052d1e2b1a3aeaf5e81243777d8bbb08689330a067

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks