General

  • Target

    02fba448a38ccab2281d34ce6b2b34f85833feb011acacc6f1c8f361caa5d89b

  • Size

    446KB

  • Sample

    220414-hp6k2aaed2

  • MD5

    c95751ada3c15c7358e0ad080093ad04

  • SHA1

    b19277b9a755c8573cd422049b55f4b5816380dd

  • SHA256

    02fba448a38ccab2281d34ce6b2b34f85833feb011acacc6f1c8f361caa5d89b

  • SHA512

    c2abba4f04067f3b2f2e5086c5e6038f4c228ec1995d79271e7d9023e8b477c3f23f93f64c2b0a6086a21a008e8f12fbf45ccbd450b536d1b3bf58d6c1da8fc7

Malware Config

Extracted

Family

lokibot

C2

http://siniormaintl.ml/officem6/logs/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      02fba448a38ccab2281d34ce6b2b34f85833feb011acacc6f1c8f361caa5d89b

    • Size

      446KB

    • MD5

      c95751ada3c15c7358e0ad080093ad04

    • SHA1

      b19277b9a755c8573cd422049b55f4b5816380dd

    • SHA256

      02fba448a38ccab2281d34ce6b2b34f85833feb011acacc6f1c8f361caa5d89b

    • SHA512

      c2abba4f04067f3b2f2e5086c5e6038f4c228ec1995d79271e7d9023e8b477c3f23f93f64c2b0a6086a21a008e8f12fbf45ccbd450b536d1b3bf58d6c1da8fc7

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks