39dd09a212d8a7d21b101ee996c9eae8

General
Target

39dd09a212d8a7d21b101ee996c9eae8

Size

398KB

Sample

220623-se1l5sgdb5

Score
10 /10
MD5

39dd09a212d8a7d21b101ee996c9eae8

SHA1

f21440c9a6952ce1c7d3f080e9dcc4666106f212

SHA256

c94e22329965dbef963ba23ee509fe92e96371b29570f3853421dde24ad91801

SHA512

44e6e43fe53efc18e6dffbed36fd072317b189f96c6d1b35d97a135d9634eb33f49639ba7a3fdb8c7773fa27e7dffa17a50be41a1ea1f806a70f8a0941f70481

Malware Config

Extracted

Family lokibot
C2

http://198.187.30.47/p.php?id=16543535265942912

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php
Targets
Target

39dd09a212d8a7d21b101ee996c9eae8

MD5

39dd09a212d8a7d21b101ee996c9eae8

Filesize

398KB

Score
10/10
SHA1

f21440c9a6952ce1c7d3f080e9dcc4666106f212

SHA256

c94e22329965dbef963ba23ee509fe92e96371b29570f3853421dde24ad91801

SHA512

44e6e43fe53efc18e6dffbed36fd072317b189f96c6d1b35d97a135d9634eb33f49639ba7a3fdb8c7773fa27e7dffa17a50be41a1ea1f806a70f8a0941f70481

Tags

Signatures

  • Lokibot

    Description

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    Tags

  • suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    Description

    suricata: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

    Tags

  • suricata: ET MALWARE LokiBot Checkin

    Description

    suricata: ET MALWARE LokiBot Checkin

    Tags

  • suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    Description

    suricata: ET MALWARE LokiBot Request for C2 Commands Detected M1

    Tags

  • suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    Description

    suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)

    Tags

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files

  • Accesses Microsoft Outlook profiles

    Tags

    TTPs

    Email Collection

  • Suspicious use of SetThreadContext

Related Tasks

behavioral1behavioral2
MITRE ATT&CK Matrix
Collection
Command and Control
    Credential Access
    Defense Evasion
      Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation