General

  • Target

    9c39ffe8104468fed8b691d138aebb310f47c43818775cd322dd8da989ca5152

  • Size

    648KB

  • Sample

    220414-pwpz7acag8

  • MD5

    c158c485a8e87e39994b497a3744e228

  • SHA1

    13246c70deab15d1302792eb40b75f67bf0ca8b1

  • SHA256

    9c39ffe8104468fed8b691d138aebb310f47c43818775cd322dd8da989ca5152

  • SHA512

    519a6b61082f09f697de4f4cee2b6bd907a076bd604ed637fa7a8c6ffc601c10a074fb4117468163492464cf44aeeb791efae7bb28d27fb8d3186220e587689d

Malware Config

Extracted

Family

lokibot

C2

http://quehenbergar.com/coast/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      9c39ffe8104468fed8b691d138aebb310f47c43818775cd322dd8da989ca5152

    • Size

      648KB

    • MD5

      c158c485a8e87e39994b497a3744e228

    • SHA1

      13246c70deab15d1302792eb40b75f67bf0ca8b1

    • SHA256

      9c39ffe8104468fed8b691d138aebb310f47c43818775cd322dd8da989ca5152

    • SHA512

      519a6b61082f09f697de4f4cee2b6bd907a076bd604ed637fa7a8c6ffc601c10a074fb4117468163492464cf44aeeb791efae7bb28d27fb8d3186220e587689d

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks