General

  • Target

    7e900d8fd5e823974352bb4203e9b5be3668d8aa415792f40db0eada31cdebb6

  • Size

    709KB

  • Sample

    220701-ezctxsdfd8

  • MD5

    45f846eba8387035eacfcb5efe5aeb74

  • SHA1

    3bfdd8980593480df8e832bf23c8c63df4579e36

  • SHA256

    7e900d8fd5e823974352bb4203e9b5be3668d8aa415792f40db0eada31cdebb6

  • SHA512

    0191c6a02cac3fe5cff963d50ce92f5fa4b28b51d487749d2dfd4f95c1af6f394de5f8a0f4560da1c45446ffe3189f5e2987ff32c9d155f2b8365f09bef454f9

Malware Config

Extracted

Family

lokibot

C2

http://107.175.150.73/~giftioz/.dycosmxiz/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      7e900d8fd5e823974352bb4203e9b5be3668d8aa415792f40db0eada31cdebb6

    • Size

      709KB

    • MD5

      45f846eba8387035eacfcb5efe5aeb74

    • SHA1

      3bfdd8980593480df8e832bf23c8c63df4579e36

    • SHA256

      7e900d8fd5e823974352bb4203e9b5be3668d8aa415792f40db0eada31cdebb6

    • SHA512

      0191c6a02cac3fe5cff963d50ce92f5fa4b28b51d487749d2dfd4f95c1af6f394de5f8a0f4560da1c45446ffe3189f5e2987ff32c9d155f2b8365f09bef454f9

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks