General

  • Target

    b62f7e9d5d3bb7b464e7c83ec0b27f602a5f6d32baaafc53256290c34f76d076

  • Size

    241KB

  • Sample

    230607-fg27jagh52

  • MD5

    4d2320d5b7d1a45d87d843ab5ab105d8

  • SHA1

    8aca8fe2dfa143a3210f00df3f43d4185fefa7a3

  • SHA256

    b62f7e9d5d3bb7b464e7c83ec0b27f602a5f6d32baaafc53256290c34f76d076

  • SHA512

    756a5174fa28851c8df7ff9797f3d3617f6e6d94c6c36bdb82597b0e7c42109b9fcbf89bd733c40ef93a239eec4e6ab77d59fdec948ba89c889db5ff187ca2ef

  • SSDEEP

    3072:J+5hexnVH2JIELvzZOPqoueYiX4zexvToQ+3cVvywLFvDXu+9hO+d:E5he72JIELvkCoU6IovToQ2cFyy5Dr

Malware Config

Extracted

Family

lokibot

C2

http://194.180.48.58/web/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      b62f7e9d5d3bb7b464e7c83ec0b27f602a5f6d32baaafc53256290c34f76d076

    • Size

      241KB

    • MD5

      4d2320d5b7d1a45d87d843ab5ab105d8

    • SHA1

      8aca8fe2dfa143a3210f00df3f43d4185fefa7a3

    • SHA256

      b62f7e9d5d3bb7b464e7c83ec0b27f602a5f6d32baaafc53256290c34f76d076

    • SHA512

      756a5174fa28851c8df7ff9797f3d3617f6e6d94c6c36bdb82597b0e7c42109b9fcbf89bd733c40ef93a239eec4e6ab77d59fdec948ba89c889db5ff187ca2ef

    • SSDEEP

      3072:J+5hexnVH2JIELvzZOPqoueYiX4zexvToQ+3cVvywLFvDXu+9hO+d:E5he72JIELvkCoU6IovToQ2cFyy5Dr

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks