General

  • Target

    TS-240301-UF1.exe

  • Size

    350KB

  • Sample

    240301-qmfwlage75

  • MD5

    bab0c0a6823d2c2a17d25aa889844353

  • SHA1

    70864a5fa82e597261378b3d85ea341b28819cda

  • SHA256

    58aca6888ae5d1b1c1f9c8601afaa23ae97723bb09d206374134fd3a61b3f610

  • SHA512

    fc066ff2db37c9d06a81de6bde211a51bc817bfb9f75ae994a034e14cb4aa10b835b6022be434a57cfc0ccc9b2710db4a0d648c0556b29239b5862313c50aef8

  • SSDEEP

    6144:jwuTTZ4PZR+enfYX+b3qHy8BXbRzdGqyEaUrnCFkTn/fIl77gv9eyDxI2mMeSINb:jwuTw6eng0Uy8BXbDGdEaUrnCk/fIl7B

Malware Config

Extracted

Family

lokibot

C2

http://91.92.252.146:8008/aioy/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      TS-240301-UF1.exe

    • Size

      350KB

    • MD5

      bab0c0a6823d2c2a17d25aa889844353

    • SHA1

      70864a5fa82e597261378b3d85ea341b28819cda

    • SHA256

      58aca6888ae5d1b1c1f9c8601afaa23ae97723bb09d206374134fd3a61b3f610

    • SHA512

      fc066ff2db37c9d06a81de6bde211a51bc817bfb9f75ae994a034e14cb4aa10b835b6022be434a57cfc0ccc9b2710db4a0d648c0556b29239b5862313c50aef8

    • SSDEEP

      6144:jwuTTZ4PZR+enfYX+b3qHy8BXbRzdGqyEaUrnCFkTn/fIl77gv9eyDxI2mMeSINb:jwuTw6eng0Uy8BXbDGdEaUrnCk/fIl7B

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks