General

  • Target

    537a22b4830c4ece6ea22debb704bdddd70fa42de016f8d38903bc6c4c78b03e

  • Size

    588KB

  • Sample

    230130-phdp1aac68

  • MD5

    a8cd85be485cd31672c1b83c2ef2d807

  • SHA1

    824bd7c6ef3c6364ce2213346f385383eaaa65b3

  • SHA256

    537a22b4830c4ece6ea22debb704bdddd70fa42de016f8d38903bc6c4c78b03e

  • SHA512

    3b9b1bca6743c060d01dfc4ee2bfd135cdf77a80320e1a94ebcbc73e887361d953c5257eac87df71d15e27d9f656a878cbddb064988778209f6910bd3a6c17a8

  • SSDEEP

    12288:a/bEnLHpKWiCEkXNltv4dIJ5Txhq34kt4Weh3ih9H1A:aDwwWiCEc9v4dIDTPqBt4BYTe

Malware Config

Extracted

Family

lokibot

C2

http://208.67.105.148/zang/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      537a22b4830c4ece6ea22debb704bdddd70fa42de016f8d38903bc6c4c78b03e

    • Size

      588KB

    • MD5

      a8cd85be485cd31672c1b83c2ef2d807

    • SHA1

      824bd7c6ef3c6364ce2213346f385383eaaa65b3

    • SHA256

      537a22b4830c4ece6ea22debb704bdddd70fa42de016f8d38903bc6c4c78b03e

    • SHA512

      3b9b1bca6743c060d01dfc4ee2bfd135cdf77a80320e1a94ebcbc73e887361d953c5257eac87df71d15e27d9f656a878cbddb064988778209f6910bd3a6c17a8

    • SSDEEP

      12288:a/bEnLHpKWiCEkXNltv4dIJ5Txhq34kt4Weh3ih9H1A:aDwwWiCEc9v4dIDTPqBt4BYTe

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks