Overview

overview

10

Static

static

3

1b023b6f6a...18.exe

windows7-x64

10

1b023b6f6a...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$TEMP/shwa.dll

windows7-x64

3

$TEMP/shwa.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118

  • Size

    344KB

  • Sample

    240506-gbedysba9x

  • MD5

    1b023b6f6a4447cd8c2d8e841f542227

  • SHA1

    397af11ba7d160ab76f3099798257c057790280a

  • SHA256

    465e437108d6f904ff77ea9a39df2e764449efeb2100c79fbba6cb092b0d3633

  • SHA512

    3326329715fc325a712607b59204a17ec1f8d19868fc644ec1fe282b5c5e40577faff17c372e1c2ab885a9f37d96e09afee4e5ca27b424f3e10140b1b7cd8150

  • SSDEEP

    6144:fWNdxridQv5Rzh+uSrEga5GJvh4BTFWSPEhaxso8zM2bGgWzRXEGPLyhq9rf7qu5:udxed4guKEge2vh4BTFWwCo0M2bEzRXn

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://kamatecpark.com/~zadmin/lmark/emma/link.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      1b023b6f6a4447cd8c2d8e841f542227_JaffaCakes118

    • Size

      344KB

    • MD5

      1b023b6f6a4447cd8c2d8e841f542227

    • SHA1

      397af11ba7d160ab76f3099798257c057790280a

    • SHA256

      465e437108d6f904ff77ea9a39df2e764449efeb2100c79fbba6cb092b0d3633

    • SHA512

      3326329715fc325a712607b59204a17ec1f8d19868fc644ec1fe282b5c5e40577faff17c372e1c2ab885a9f37d96e09afee4e5ca27b424f3e10140b1b7cd8150

    • SSDEEP

      6144:fWNdxridQv5Rzh+uSrEga5GJvh4BTFWSPEhaxso8zM2bGgWzRXEGPLyhq9rf7qu5:udxed4guKEge2vh4BTFWwCo0M2bEzRXn

    Score
    10/10
    lokibotcollectionspywarestealertrojan
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      fbe295e5a1acfbd0a6271898f885fe6a

    • SHA1

      d6d205922e61635472efb13c2bb92c9ac6cb96da

    • SHA256

      a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

    • SHA512

      2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

    • SSDEEP

      192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      ab101f38562c8545a641e95172c354b4

    • SHA1

      ec47ac5449f6ee4b14f6dd7ddde841a3e723e567

    • SHA256

      3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea

    • SHA512

      72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037

    • SSDEEP

      96:o3W4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4K8qndYv0PLE:o3p3ggQF8REskpxZdO0PLE

    Score
    3/10
    behavioral5behavioral6

    • Target

      $TEMP/shwa.dll

    • Size

      23KB

    • MD5

      e9f0406091c6e24979d02df7e6af742c

    • SHA1

      2962e5b0043d6bcd777be53877fba3e6ade3dbe5

    • SHA256

      a134f9624f6f880bfd2ba5b242e519961af92de5d22733892fe2373e0083ffd4

    • SHA512

      45db0bce7c6f165fa15597d70e7da7abff0cb0e824a44f2516809157177ca7ccda0ddd0e2c74ba10be657be94700bb9d2ad81399143be94166802590ce74f5d2

    • SSDEEP

      384:zUOLqD8OaFumDTsk2MjMdoShZrmunRyjEuG+CB+rA390dRYvo2Udpufhb7z0:zUO2DvYuKTskFQvf5UjEuvC132YvMufO

    Score
    3/10
    behavioral7behavioral8

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks