Overview

overview

10

Static

static

3

e9f41ccc3a...18.exe

windows7-x64

10

e9f41ccc3a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e9f41ccc3ab37c564f8e733d497edbd8_JaffaCakes118

  • Size

    224KB

  • Sample

    240409-padd9see47

  • MD5

    e9f41ccc3ab37c564f8e733d497edbd8

  • SHA1

    7afcc2b9022a0b83c936686dbe7d5e54a890de64

  • SHA256

    227c68e21120251881438e05eb3c29d6f0e59d9e97b8e646707f74992773fde1

  • SHA512

    2c1ffe427d62ef7e752f6f3d4676d1f554b69a6e418664b201d41905aaccd63aeee02326d7c18248163ee63e5cfea8a9cc1b3580ab9e1f6e1ff3b69e58ba9bde

  • SSDEEP

    6144:+qR+/kikPwglnwZJJM8Z11D+pbmT0up9H:B+/kx9lnwzcplup9H

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://brokenethicalgod.ml/BN11/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      e9f41ccc3ab37c564f8e733d497edbd8_JaffaCakes118

    • Size

      224KB

    • MD5

      e9f41ccc3ab37c564f8e733d497edbd8

    • SHA1

      7afcc2b9022a0b83c936686dbe7d5e54a890de64

    • SHA256

      227c68e21120251881438e05eb3c29d6f0e59d9e97b8e646707f74992773fde1

    • SHA512

      2c1ffe427d62ef7e752f6f3d4676d1f554b69a6e418664b201d41905aaccd63aeee02326d7c18248163ee63e5cfea8a9cc1b3580ab9e1f6e1ff3b69e58ba9bde

    • SSDEEP

      6144:+qR+/kikPwglnwZJJM8Z11D+pbmT0up9H:B+/kx9lnwzcplup9H

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks