General

  • Target

    d5032a79b95be7ad05d38d1ae3c7f26f

  • Size

    538KB

  • Sample

    240319-c755bsfd49

  • MD5

    d5032a79b95be7ad05d38d1ae3c7f26f

  • SHA1

    430594789e765a2e5a956d056a9868696160060c

  • SHA256

    5da233d0af3767b7b5434003a6d6289750d09cfc8b984e2769f7643b7bba9e84

  • SHA512

    1b37fae06360b707c958cf912ae0e7f6fbfccaf5943a58b4e7080fe04aa770c445a78ed3aabfe0407fd13faa6503bf8af4d1cb3906e0295dc5df1d68357f1b29

  • SSDEEP

    12288:cNScfPpLsclvAUeG++/oZCJQxpjuikWFbatgJMnNiqRxA:cM+pL3lYp+Q9xpjuikW0jnQUxA

Malware Config

Extracted

Family

lokibot

C2

https://www.rnofinancial.com.au/wp02/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      ENQUIRIES.exe

    • Size

      753KB

    • MD5

      50c7ebc89793bd7c8ba93468efec11dc

    • SHA1

      803ac40bd7cc00447efc9dbf81012fe43d67c593

    • SHA256

      1d6fd54291eed895054d2c88063cadac20c03b9a806b6eaec65d8a5e20af560e

    • SHA512

      a44e9d91ca66849989bd9f367de6a9ec55cfd3f6e31a9288f133075477edab0348a4b2080becbd40cd2fe4c794c9ed1c49f696be79b44216dc2725adfc9aacc7

    • SSDEEP

      12288:shVsgnLAc4C+E/cZOJyx1jiiyWFbMx6JcnNCqtxY:shVpnM/E0dx1jiiyW6Xn8OxY

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks