General

  • Target
    9177f14e0d7d1d964d16e5c962b28ada
  • Size 333KB
  • Sample220126-rr18rsdgcp
  • SHA256 d7111ee837aa260812a1fdf5ff6dafcb24e1d86bc9e4524db4f7dedf654ee4c3
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • lokibot

C2
  • http://secure01-redirect.net/gc14/fre.php

  • http://kbfvzoboss.bid/alien/fre.php

  • http://alphastand.trade/alien/fre.php

  • http://alphastand.win/alien/fre.php

  • http://alphastand.top/alien/fre.php

Targets

    • Target
      9177f14e0d7d1d964d16e5c962b28ada
    • Size 333KB
    • SHA256 d7111ee837aa260812a1fdf5ff6dafcb24e1d86bc9e4524db4f7dedf654ee4c3
    • MD5 SHA1 SHA512
    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • suricata: ET MALWARE LokiBot Checkin

      suricata: ET MALWARE LokiBot Checkin

    • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

      suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks