General

  • Target

    FedEx_2711734880.exe

  • Size

    777KB

  • Sample

    230628-g4xe8sge28

  • MD5

    c43de6a0ddfb3e3016de5b0bdf037f67

  • SHA1

    68de692f9a449ac782937aa10d4d2eb9f076ed32

  • SHA256

    03b5b853e3e2fae29872f7f2f4d278d8feffb431d210a8c6b458053987d4fa00

  • SHA512

    50d77ea343092f684a67bac9eb83b0b037d4a069cc97471e9a04ba66f28f999461474247685d24fc25fead3b7a62316e6b6bf3d8d76ef18d890a54251b1e6a53

  • SSDEEP

    12288:BNK7k4sCSuIzu//IzWtdZkZeWe5VvUXi1Zb:BQ+Zza/sWtdV1J

Malware Config

Extracted

Family

lokibot

C2

http://161.35.102.56/~nikol/?p=61353

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      FedEx_2711734880.exe

    • Size

      777KB

    • MD5

      c43de6a0ddfb3e3016de5b0bdf037f67

    • SHA1

      68de692f9a449ac782937aa10d4d2eb9f076ed32

    • SHA256

      03b5b853e3e2fae29872f7f2f4d278d8feffb431d210a8c6b458053987d4fa00

    • SHA512

      50d77ea343092f684a67bac9eb83b0b037d4a069cc97471e9a04ba66f28f999461474247685d24fc25fead3b7a62316e6b6bf3d8d76ef18d890a54251b1e6a53

    • SSDEEP

      12288:BNK7k4sCSuIzu//IzWtdZkZeWe5VvUXi1Zb:BQ+Zza/sWtdV1J

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks