General

  • Target

    3e0b70234f88c126bc5edaca8bec7c3798328566460445f67dbea502829496fb

  • Size

    716KB

  • Sample

    220701-qwp6magaa7

  • MD5

    119d5369b4334ab59977eda4d93984b0

  • SHA1

    448f5473003937b6f6a826799ab4c5bbc6479788

  • SHA256

    3e0b70234f88c126bc5edaca8bec7c3798328566460445f67dbea502829496fb

  • SHA512

    1abcfbfcd1ebaf8059c60a1e7896281c01f00b083f3dc17b710f7f67b456c09fb46401977394b6631c18d5e8f851ab0aea52ab330be2bb84f7a77a0a7ce6b5eb

Malware Config

Extracted

Family

lokibot

C2

http://dtup.ir/dtup.ir/erp/Panel/five/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      3e0b70234f88c126bc5edaca8bec7c3798328566460445f67dbea502829496fb

    • Size

      716KB

    • MD5

      119d5369b4334ab59977eda4d93984b0

    • SHA1

      448f5473003937b6f6a826799ab4c5bbc6479788

    • SHA256

      3e0b70234f88c126bc5edaca8bec7c3798328566460445f67dbea502829496fb

    • SHA512

      1abcfbfcd1ebaf8059c60a1e7896281c01f00b083f3dc17b710f7f67b456c09fb46401977394b6631c18d5e8f851ab0aea52ab330be2bb84f7a77a0a7ce6b5eb

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks