General

  • Target

    f151c4d9ea6f201827c1b36d882505af0e6ab2760c961595fcce8bcb4924a24e

  • Size

    816KB

  • Sample

    230202-d5rplage7v

  • MD5

    6fca1ec5c5fff1a2d116dfad2dd9dd17

  • SHA1

    1f54dc9048fba6cb81d0062bd86180c11325c849

  • SHA256

    f151c4d9ea6f201827c1b36d882505af0e6ab2760c961595fcce8bcb4924a24e

  • SHA512

    440cff302c29474d8493fde0a10beda289ab3f02de327e2396b68caa92244cfca6c8427f0cae419891ab527c8f7dc77aba7ab4f99f7a353ec6fd3368df6e517b

  • SSDEEP

    24576:Sx9p9Hl6pqW9gE+lLHv46F0xMpqG4yPafD:I9HOLOE+dHvdWiqL

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.147/kelly/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      f151c4d9ea6f201827c1b36d882505af0e6ab2760c961595fcce8bcb4924a24e

    • Size

      816KB

    • MD5

      6fca1ec5c5fff1a2d116dfad2dd9dd17

    • SHA1

      1f54dc9048fba6cb81d0062bd86180c11325c849

    • SHA256

      f151c4d9ea6f201827c1b36d882505af0e6ab2760c961595fcce8bcb4924a24e

    • SHA512

      440cff302c29474d8493fde0a10beda289ab3f02de327e2396b68caa92244cfca6c8427f0cae419891ab527c8f7dc77aba7ab4f99f7a353ec6fd3368df6e517b

    • SSDEEP

      24576:Sx9p9Hl6pqW9gE+lLHv46F0xMpqG4yPafD:I9HOLOE+dHvdWiqL

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks