Overview

overview

10

Static

static

3

087cb4fc52...da.exe

windows7-x64

10

087cb4fc52...da.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8219295cc4ac381cd048fe816926147_JaffaCakes118

  • Size

    535KB

  • Sample

    240408-w6hr7agb89

  • MD5

    e8219295cc4ac381cd048fe816926147

  • SHA1

    0a55a3b854b5d6a88562da2d31c33bf6f10a7b89

  • SHA256

    8262b2bfaafdeac857fc62dad45d02cdaddb8457f317549b3176717c1223c790

  • SHA512

    51be84e4eebbd486510e28f276f5bf511acc22fb0edceaf1db408388db89b951885e3d6aa4689c4d004ee48ecfd12539f75f151876d57c35e1cf386ace057b8e

  • SSDEEP

    12288:QtaBzTvJ+DFn/sq7mugyIfxazLfRQ7QpOauaEGqybjd7st:TBvB+B/DSyExazLftiKL0

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://megatechs8.com/chief/dv2/blly/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      087cb4fc52df1c6d245ce0f1486b2c1d3020349d90546eff9700666facf694da

    • Size

      687KB

    • MD5

      596fd3b53a765f98a38960301af17b58

    • SHA1

      5db45c9614b8c74eff8894e04a46bdb371d831f6

    • SHA256

      087cb4fc52df1c6d245ce0f1486b2c1d3020349d90546eff9700666facf694da

    • SHA512

      3b13dbef54ded7f75db19ec8160dee17146333a1f0f80be011f66834b1af5f9b2ffa00ccc1b59dae9b74ee2b44737205c7c61edfc37de66c8f0a94c818867b35

    • SSDEEP

      12288:TDwLMIDeK/RilfOKp/wEXlqpVT882DtX8QrYkftj951w:T0bKaRilfOiX4HTX2KQrYQ31

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks