General

  • Target

    6682d4c801b131d5de5810898709e48f858f7204de3fbe9eedd08d7649202a4b.exe

  • Size

    855KB

  • Sample

    240416-bk1ewsfd3w

  • MD5

    7d429931b4028877a01bc1b8af131394

  • SHA1

    237319bed39b32aa4878479043c74ef958f75df5

  • SHA256

    6682d4c801b131d5de5810898709e48f858f7204de3fbe9eedd08d7649202a4b

  • SHA512

    724d8e12592f2edc8d2e163b888ac80aa35d083cde9969a2241f1abf504a574d12ae105270a7882e4d68c8228a9905e5c4a5afbf7e19d560139871b3e021065f

  • SSDEEP

    12288:v3n4NBHPdHG2Qj8M+hFJHW8265co/G/DEl4MVonUp8p:f4NZJo4hjV5jJSiouU

Malware Config

Extracted

Family

lokibot

C2

https://sempersim.su/c6/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      6682d4c801b131d5de5810898709e48f858f7204de3fbe9eedd08d7649202a4b.exe

    • Size

      855KB

    • MD5

      7d429931b4028877a01bc1b8af131394

    • SHA1

      237319bed39b32aa4878479043c74ef958f75df5

    • SHA256

      6682d4c801b131d5de5810898709e48f858f7204de3fbe9eedd08d7649202a4b

    • SHA512

      724d8e12592f2edc8d2e163b888ac80aa35d083cde9969a2241f1abf504a574d12ae105270a7882e4d68c8228a9905e5c4a5afbf7e19d560139871b3e021065f

    • SSDEEP

      12288:v3n4NBHPdHG2Qj8M+hFJHW8265co/G/DEl4MVonUp8p:f4NZJo4hjV5jJSiouU

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables containing common artifacts observed in infostealers

    • Detects executables packed with SmartAssembly

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks