Overview

overview

10

Static

static

3

f1df57ba91...18.exe

windows7-x64

10

f1df57ba91...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1df57ba91c07b666d9ca3131e15dfd5_JaffaCakes118

  • Size

    777KB

  • Sample

    240415-zderlshh2w

  • MD5

    f1df57ba91c07b666d9ca3131e15dfd5

  • SHA1

    bb9d3f5597fb5fa04fa8d7d3648eb556d59f2009

  • SHA256

    c0261a915b8ef7a5923925250cf7722c195462cb28ee9fc4658f194b4ee134a1

  • SHA512

    31f251751a65f840acfbaa763c51f0863e0792b65a05ff58c7c74e82a8307bb472ac3386ea11ec3262902594ed780504bb8eee1b4c4a43c18c9035a0c310f2b9

  • SSDEEP

    24576:3oKfPp9AR95y1Cdv4W2RKriSzf+xj85B:lPpKRy14J2Idzf+xj

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://185.227.139.5/sxisodifntose.php/ADdkqqfZahlYB

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      f1df57ba91c07b666d9ca3131e15dfd5_JaffaCakes118

    • Size

      777KB

    • MD5

      f1df57ba91c07b666d9ca3131e15dfd5

    • SHA1

      bb9d3f5597fb5fa04fa8d7d3648eb556d59f2009

    • SHA256

      c0261a915b8ef7a5923925250cf7722c195462cb28ee9fc4658f194b4ee134a1

    • SHA512

      31f251751a65f840acfbaa763c51f0863e0792b65a05ff58c7c74e82a8307bb472ac3386ea11ec3262902594ed780504bb8eee1b4c4a43c18c9035a0c310f2b9

    • SSDEEP

      24576:3oKfPp9AR95y1Cdv4W2RKriSzf+xj85B:lPpKRy14J2Idzf+xj

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks