General

  • Target

    9d2cb12118d3f3e4ff3d14c61ebab4e0.exe

  • Size

    249KB

  • Sample

    230328-lpcjqsbh8w

  • MD5

    9d2cb12118d3f3e4ff3d14c61ebab4e0

  • SHA1

    ff76a4565f865c1d00a36cb5ff1e954844f458b1

  • SHA256

    deb87612197e1b89de04867bb299f14709ec07538e300ad3f466da7fd4ffec72

  • SHA512

    f4f4cbd1b4312f739a7c303c2d64b5a5713853a39a886158863422d65b6700eb2695869b26189a104aea5f4b8e1d37db1713350995955332886648cc49ca2ef3

  • SSDEEP

    3072:kXfaHy7wiJlYLaAfjppRMx36YhMz1oHotCU5tVikJcIaNwuj5Evck+sic:iOy7rYLrZMFMzFtCUXZjlT0k+s

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/china/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      9d2cb12118d3f3e4ff3d14c61ebab4e0.exe

    • Size

      249KB

    • MD5

      9d2cb12118d3f3e4ff3d14c61ebab4e0

    • SHA1

      ff76a4565f865c1d00a36cb5ff1e954844f458b1

    • SHA256

      deb87612197e1b89de04867bb299f14709ec07538e300ad3f466da7fd4ffec72

    • SHA512

      f4f4cbd1b4312f739a7c303c2d64b5a5713853a39a886158863422d65b6700eb2695869b26189a104aea5f4b8e1d37db1713350995955332886648cc49ca2ef3

    • SSDEEP

      3072:kXfaHy7wiJlYLaAfjppRMx36YhMz1oHotCU5tVikJcIaNwuj5Evck+sic:iOy7rYLrZMFMzFtCUXZjlT0k+s

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks