General

  • Target

    3b3c91a308cd51af804269cf6dd0b74417a3a32d9920a89a886dc01a7e513a06

  • Size

    966KB

  • Sample

    220703-vpztpsbgf7

  • MD5

    8e43399089af0674bac08581b8ac9ebf

  • SHA1

    41e7e0caea9be36a66a4b1093ff7b3cd42098709

  • SHA256

    3b3c91a308cd51af804269cf6dd0b74417a3a32d9920a89a886dc01a7e513a06

  • SHA512

    534904558af467e1d935bc648c37bb487ed93f7b2ab4d3505b281117c8c886c505167430821cba004562f5ec52d04973ec8295a0dec38898c6343171205bff64

Malware Config

Extracted

Family

lokibot

C2

http://smartswift1.cf/Loki2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      3b3c91a308cd51af804269cf6dd0b74417a3a32d9920a89a886dc01a7e513a06

    • Size

      966KB

    • MD5

      8e43399089af0674bac08581b8ac9ebf

    • SHA1

      41e7e0caea9be36a66a4b1093ff7b3cd42098709

    • SHA256

      3b3c91a308cd51af804269cf6dd0b74417a3a32d9920a89a886dc01a7e513a06

    • SHA512

      534904558af467e1d935bc648c37bb487ed93f7b2ab4d3505b281117c8c886c505167430821cba004562f5ec52d04973ec8295a0dec38898c6343171205bff64

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks