General

  • Target

    ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1

  • Size

    353KB

  • Sample

    240305-jpeb8aaa5s

  • MD5

    ae4219dc1d5bd6f693cc75c135539ce4

  • SHA1

    377b8aafc18502fa2e7430e5bca79a411aaac5ef

  • SHA256

    ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1

  • SHA512

    2e2bfb3e7d38e0025b4e7849943e3bedad9c5daa0713b66dfaeda615544d5e3963a44bc1221a7a95d09201161a49cf5dba285f4114bc4193154b5dfac03926ed

  • SSDEEP

    6144:E9Y/0Vkb4LFo2yXafnftfjmBaIEtUYvlkUEL8BhAe2qQQuYP4Lb+nxpddhRI:Z/wzFo2LnfzIE6ulZxh+3YPG+nxpddhK

Malware Config

Extracted

Family

lokibot

C2

http://91.92.252.146:8015/wioy/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1

    • Size

      353KB

    • MD5

      ae4219dc1d5bd6f693cc75c135539ce4

    • SHA1

      377b8aafc18502fa2e7430e5bca79a411aaac5ef

    • SHA256

      ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1

    • SHA512

      2e2bfb3e7d38e0025b4e7849943e3bedad9c5daa0713b66dfaeda615544d5e3963a44bc1221a7a95d09201161a49cf5dba285f4114bc4193154b5dfac03926ed

    • SSDEEP

      6144:E9Y/0Vkb4LFo2yXafnftfjmBaIEtUYvlkUEL8BhAe2qQQuYP4Lb+nxpddhRI:Z/wzFo2LnfzIE6ulZxh+3YPG+nxpddhK

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables containing common artifacts observed in infostealers

    • Detects executables packed with ConfuserEx Mod

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks