General

  • Target

    45d30030e239b7243f97c05ed52dc4ad9fa3341dbf9c81044742867547abf3e2

  • Size

    775KB

  • Sample

    220707-msc54sfeh7

  • MD5

    7f75700a46751dc62786afbd73e8ca31

  • SHA1

    7773fe6984907d111bc879ef93786a39d869d42b

  • SHA256

    45d30030e239b7243f97c05ed52dc4ad9fa3341dbf9c81044742867547abf3e2

  • SHA512

    65593bb1fec40c76d9fd0e578dbce9108cd6f0f92dce027b3647292fe3917b488c8a2e89ac29126c11e020a72058739977eeab7e67b8f503565670db051af159

Malware Config

Extracted

Family

lokibot

C2

http://107.175.150.73/~giftioz/.hoki/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      45d30030e239b7243f97c05ed52dc4ad9fa3341dbf9c81044742867547abf3e2

    • Size

      775KB

    • MD5

      7f75700a46751dc62786afbd73e8ca31

    • SHA1

      7773fe6984907d111bc879ef93786a39d869d42b

    • SHA256

      45d30030e239b7243f97c05ed52dc4ad9fa3341dbf9c81044742867547abf3e2

    • SHA512

      65593bb1fec40c76d9fd0e578dbce9108cd6f0f92dce027b3647292fe3917b488c8a2e89ac29126c11e020a72058739977eeab7e67b8f503565670db051af159

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks