Overview

overview

10

Static

static

1

2423f7f476...18.msi

windows7-x64

10

2423f7f476...18.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2423f7f4760abde3ea56dc0fe3c2ca64_JaffaCakes118

  • Size

    336KB

  • Sample

    240508-k2zdlafd78

  • MD5

    2423f7f4760abde3ea56dc0fe3c2ca64

  • SHA1

    c6355248b01b1257f61c0fba4d4f2e3302a1ebcf

  • SHA256

    a4f95f33320c2520836f546c933cdb167943aa51e8ee7001f72e9adbaf442fe4

  • SHA512

    6192745ba233057508c3f65134a04be1f4f2fc8b0f1f273bcda7de43126c14cb43711318210cddde0fd2f0af3e4414c798863fb75ccd8266e6541b7296160342

  • SSDEEP

    3072:zEbCnCdktWk9hvJls5fPzBRvwbEn5OiWzWq6tC:zEupxhiHzB2o0iC6

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://www.crownventureintl.com/wip-admin/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      2423f7f4760abde3ea56dc0fe3c2ca64_JaffaCakes118

    • Size

      336KB

    • MD5

      2423f7f4760abde3ea56dc0fe3c2ca64

    • SHA1

      c6355248b01b1257f61c0fba4d4f2e3302a1ebcf

    • SHA256

      a4f95f33320c2520836f546c933cdb167943aa51e8ee7001f72e9adbaf442fe4

    • SHA512

      6192745ba233057508c3f65134a04be1f4f2fc8b0f1f273bcda7de43126c14cb43711318210cddde0fd2f0af3e4414c798863fb75ccd8266e6541b7296160342

    • SSDEEP

      3072:zEbCnCdktWk9hvJls5fPzBRvwbEn5OiWzWq6tC:zEupxhiHzB2o0iC6

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks