General

  • Target

    0ca11514fa607fd0fbc83af26d8dfd7fc94e76d48eab7b5fcf582dd3367da9fd

  • Size

    637KB

  • Sample

    220414-pxrv6sghgq

  • MD5

    446511c25709e564f88bcca43f819ce8

  • SHA1

    cf73765b401d65c14b530291c07754c773a606aa

  • SHA256

    0ca11514fa607fd0fbc83af26d8dfd7fc94e76d48eab7b5fcf582dd3367da9fd

  • SHA512

    65dea6d1f8891c3e673e0368795cc41752e023f089064123e2296ebb8839e6daf38dc93ae59213a07cc482ea1d6223ccb8143f420b66b7d957aa19a0eeb8be11

Malware Config

Extracted

Family

lokibot

C2

http://sieqwarteg.com/chief/alhaji/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      0ca11514fa607fd0fbc83af26d8dfd7fc94e76d48eab7b5fcf582dd3367da9fd

    • Size

      637KB

    • MD5

      446511c25709e564f88bcca43f819ce8

    • SHA1

      cf73765b401d65c14b530291c07754c773a606aa

    • SHA256

      0ca11514fa607fd0fbc83af26d8dfd7fc94e76d48eab7b5fcf582dd3367da9fd

    • SHA512

      65dea6d1f8891c3e673e0368795cc41752e023f089064123e2296ebb8839e6daf38dc93ae59213a07cc482ea1d6223ccb8143f420b66b7d957aa19a0eeb8be11

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Meta Stealer Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks