General

  • Target

    [External] Purchase Order from Telkomsel.exe

  • Size

    483KB

  • Sample

    240314-jca42adg7s

  • MD5

    dbde6d96e328c169028b2673d4d89d27

  • SHA1

    d3991b143298c33c56300595cc5b8c9ae870675d

  • SHA256

    366c3e4f90b97f849ae44a2d0f6c6d78b9dab71582e3fbeca225180b39d589b3

  • SHA512

    e85c0ba365dbfa8447eb4f5c8bbac5d236811e952f8ab223248067b958ca32e4242df66c3cbe2a3c1cf015cd90249f36e4b884c850a760326a0dac0c7d333ece

  • SSDEEP

    12288:eTfGjfehmBjCtepTyqlf7cIm0XtTofGhqk1cS7EVw2XN:eTfGjsmBUoTRf7ZjtTdH1x7J2XN

Malware Config

Extracted

Family

lokibot

C2

https://mauricioclopatofsky.tel/user/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      [External] Purchase Order from Telkomsel.exe

    • Size

      483KB

    • MD5

      dbde6d96e328c169028b2673d4d89d27

    • SHA1

      d3991b143298c33c56300595cc5b8c9ae870675d

    • SHA256

      366c3e4f90b97f849ae44a2d0f6c6d78b9dab71582e3fbeca225180b39d589b3

    • SHA512

      e85c0ba365dbfa8447eb4f5c8bbac5d236811e952f8ab223248067b958ca32e4242df66c3cbe2a3c1cf015cd90249f36e4b884c850a760326a0dac0c7d333ece

    • SSDEEP

      12288:eTfGjfehmBjCtepTyqlf7cIm0XtTofGhqk1cS7EVw2XN:eTfGjsmBUoTRf7ZjtTdH1x7J2XN

MITRE ATT&CK Enterprise v15

Tasks