General

  • Target

    fdc78ab84bc217516144c18c8e870e66.exe

  • Size

    291KB

  • Sample

    230610-md8cpsfd9y

  • MD5

    fdc78ab84bc217516144c18c8e870e66

  • SHA1

    0080a713d289ce6227f5b3e71085bd21a204028a

  • SHA256

    158bae12643652c0e08748cf318ef34fa3cf4943e1fb0cad03e7a8145b55c0c4

  • SHA512

    bc3e590286bd616dd1444cfbe4fc51a38f248342687e20a9b4357901bb1b01409a20ba75ffe29bcc701ac279ff3eb30ac72b7f5687d4f582b77a6ea0100b6f81

  • SSDEEP

    3072:JJF5ZzPen63i0SBt7DQ4mmODq0wwvESv7OHNa5tUg3y69dYp:hNi0SBpDeqkvEq5P9

Malware Config

Extracted

Family

lokibot

C2

http://171.22.30.164/chang3/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      fdc78ab84bc217516144c18c8e870e66.exe

    • Size

      291KB

    • MD5

      fdc78ab84bc217516144c18c8e870e66

    • SHA1

      0080a713d289ce6227f5b3e71085bd21a204028a

    • SHA256

      158bae12643652c0e08748cf318ef34fa3cf4943e1fb0cad03e7a8145b55c0c4

    • SHA512

      bc3e590286bd616dd1444cfbe4fc51a38f248342687e20a9b4357901bb1b01409a20ba75ffe29bcc701ac279ff3eb30ac72b7f5687d4f582b77a6ea0100b6f81

    • SSDEEP

      3072:JJF5ZzPen63i0SBt7DQ4mmODq0wwvESv7OHNa5tUg3y69dYp:hNi0SBpDeqkvEq5P9

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks