Overview

overview

10

Static

static

3

fe0f606f95...18.exe

windows7-x64

10

fe0f606f95...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fe0f606f95053efa7caac58ef465794f_JaffaCakes118

  • Size

    835KB

  • Sample

    240421-bdakwsef98

  • MD5

    fe0f606f95053efa7caac58ef465794f

  • SHA1

    6c241fd13a0934630727c061372082e4254e8cbc

  • SHA256

    425ade725d835eb86e86d4a0e7f537e92d9d8538640c2d1b8d75d6acc334b827

  • SHA512

    55983b45973673b087d9bb88a0032252f4b76f756ad7acc97e8bcce0c357672a22958067b256a0d0d93463ab6d00444cfb6d2d048fd4ef72b54cc04f2a9a9643

  • SSDEEP

    12288:rgDc9F3nC0Py3gAhkd5sIxRLYCVUkiXkCvsh4p/bWQpnUYB0m7vXltUzpnL5tlv:rXsIxRLPUki/jpBnULC0

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://185.227.139.5/sxisodifntose.php/4LlT7SRZcUYvF

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      fe0f606f95053efa7caac58ef465794f_JaffaCakes118

    • Size

      835KB

    • MD5

      fe0f606f95053efa7caac58ef465794f

    • SHA1

      6c241fd13a0934630727c061372082e4254e8cbc

    • SHA256

      425ade725d835eb86e86d4a0e7f537e92d9d8538640c2d1b8d75d6acc334b827

    • SHA512

      55983b45973673b087d9bb88a0032252f4b76f756ad7acc97e8bcce0c357672a22958067b256a0d0d93463ab6d00444cfb6d2d048fd4ef72b54cc04f2a9a9643

    • SSDEEP

      12288:rgDc9F3nC0Py3gAhkd5sIxRLYCVUkiXkCvsh4p/bWQpnUYB0m7vXltUzpnL5tlv:rXsIxRLPUki/jpBnULC0

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks