General

  • Target

    9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5

  • Size

    448KB

  • Sample

    220414-hnfcfsadf4

  • MD5

    d06fef9cf7c5f43fad88091d0a3748b4

  • SHA1

    2abdb8a55d14c8ca00ae4f121cc9ebb5fc504ce3

  • SHA256

    9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5

  • SHA512

    bfedf0ca28dec1df18064c13c7868fb85192c9087ad20db0ba86dc5570145669c0c8874dd5ae0d72bd83470ec1341c94477201b025328cbfa056b39084a0d361

Malware Config

Extracted

Family

lokibot

C2

http://magicview.ga/chang/gate.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5

    • Size

      448KB

    • MD5

      d06fef9cf7c5f43fad88091d0a3748b4

    • SHA1

      2abdb8a55d14c8ca00ae4f121cc9ebb5fc504ce3

    • SHA256

      9cf60ba314ffa7477aad20341cbf765fadccb54f1e49a0decea5dde63451b4e5

    • SHA512

      bfedf0ca28dec1df18064c13c7868fb85192c9087ad20db0ba86dc5570145669c0c8874dd5ae0d72bd83470ec1341c94477201b025328cbfa056b39084a0d361

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks