General

  • Target

    d7111ee837aa260812a1fdf5ff6dafcb24e1d86bc9e4524db4f7dedf654ee4c3

  • Size

    333KB

  • Sample

    220126-qxm3nadcbr

  • MD5

    9177f14e0d7d1d964d16e5c962b28ada

  • SHA1

    5696acbf643f7557597879860fc11089ab86b16a

  • SHA256

    d7111ee837aa260812a1fdf5ff6dafcb24e1d86bc9e4524db4f7dedf654ee4c3

  • SHA512

    1007e23fc7dd2947dab291c71447743ed3fc87e54763e19d66cf5961cffd43cc49e761e5270f976175cac3099adf33f55a47c41ab20d54cea365bda5f41fb3a2

Malware Config

Extracted

Family

lokibot

C2

http://secure01-redirect.net/gc14/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      d7111ee837aa260812a1fdf5ff6dafcb24e1d86bc9e4524db4f7dedf654ee4c3

    • Size

      333KB

    • MD5

      9177f14e0d7d1d964d16e5c962b28ada

    • SHA1

      5696acbf643f7557597879860fc11089ab86b16a

    • SHA256

      d7111ee837aa260812a1fdf5ff6dafcb24e1d86bc9e4524db4f7dedf654ee4c3

    • SHA512

      1007e23fc7dd2947dab291c71447743ed3fc87e54763e19d66cf5961cffd43cc49e761e5270f976175cac3099adf33f55a47c41ab20d54cea365bda5f41fb3a2

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • suricata: ET MALWARE LokiBot Checkin

      suricata: ET MALWARE LokiBot Checkin

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks