Overview

overview

10

Static

static

3

2b7b6fc8b0...18.exe

windows7-x64

10

2b7b6fc8b0...18.exe

windows10-2004-x64

7

$PLUGINSDI...sh.dll

windows7-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$TEMP/glee.dll

windows7-x64

1

$TEMP/glee.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2b7b6fc8b0a2e9fda739eb8aa8ee6d57_JaffaCakes118

  • Size

    281KB

  • Sample

    240509-ywec5afb69

  • MD5

    2b7b6fc8b0a2e9fda739eb8aa8ee6d57

  • SHA1

    106814657fd903bb289f89679eb6b0ccd877e292

  • SHA256

    2a74e566b9590e7225627b3c7a262162cb09077bc04c87347e40cd693c03718b

  • SHA512

    59a6699a04d1bc3fe0c420969a327c6afcde6e15c09c28f655e9c093e394ef214373d0d7f1ab3fbde143b949cb7511a93beb5c03ed17c29a4aa98b9e0d528c8b

  • SSDEEP

    6144:S58KGEq8JpicwCI4WT+Vhri8y6aQlAbfUxiRmyJjZMiv:NAq8jc4Hhr/y6YUxQCiv

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://palacegrades.com/~zadmin/lmark/fberg/link.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      2b7b6fc8b0a2e9fda739eb8aa8ee6d57_JaffaCakes118

    • Size

      281KB

    • MD5

      2b7b6fc8b0a2e9fda739eb8aa8ee6d57

    • SHA1

      106814657fd903bb289f89679eb6b0ccd877e292

    • SHA256

      2a74e566b9590e7225627b3c7a262162cb09077bc04c87347e40cd693c03718b

    • SHA512

      59a6699a04d1bc3fe0c420969a327c6afcde6e15c09c28f655e9c093e394ef214373d0d7f1ab3fbde143b949cb7511a93beb5c03ed17c29a4aa98b9e0d528c8b

    • SSDEEP

      6144:S58KGEq8JpicwCI4WT+Vhri8y6aQlAbfUxiRmyJjZMiv:NAq8jc4Hhr/y6YUxQCiv

    Score
    10/10
    lokibotcollectionspywarestealertrojan
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/Splash.dll

    • Size

      4KB

    • MD5

      3f35f73787f0c3bb5e59445fb18ade0d

    • SHA1

      f1566faff96c3988cfc28dc7d433094b6348cdbf

    • SHA256

      5570969d22a33c23b60c5f5536f781219e458a869b77b8dde4a94cc124ee4de6

    • SHA512

      45c42ea95f53a3b8a3fd74bd55ad6f0b3f2b91dd969104de845fd819fe307dec2b4d472bee45554500b0c51052ee82ac98196e894af806edf67a947328474e57

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      fbe295e5a1acfbd0a6271898f885fe6a

    • SHA1

      d6d205922e61635472efb13c2bb92c9ac6cb96da

    • SHA256

      a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

    • SHA512

      2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

    • SSDEEP

      192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/UserInfo.dll

    • Size

      4KB

    • MD5

      7836f464ae0102452e94a363b491b759

    • SHA1

      59909a48448b99e2eb9cd336d81d60764da59f31

    • SHA256

      11adf8916947b5a20a071b494fa034cf62769dcc6293a1340b29a5bb29ac8e87

    • SHA512

      5ed63eefa1b3b3caad4cb762ccb8419c05bcad3da3a7415235cda2d2a1f79eb018503ca30a0a92d6b72160327decea9a70c48e0c28de94dd67303d4aea4a02db

    Score
    3/10
    behavioral7behavioral8

    • Target

      $TEMP/glee.dll

    • Size

      34KB

    • MD5

      9efcdaec062823e9749250da225dfe4d

    • SHA1

      1d6209a71c061729683ce81890f2d8c0c02c6e05

    • SHA256

      04904de1d15bb931cf85eadb7714bd53f7236de0fbc1f62c22aafb3470ff847c

    • SHA512

      b7faee0a4c769ee39fc11fe20c6ec362b6802e9fd7f81d8a495f1423263af8074cf995c1ff8d964680c10c3026e69ddb66e749b9b29784309502d805673a720a

    • SSDEEP

      768:tyxfTX4H2MoxHO1iB94vJfIhdV2GLkBrNj2+QE8u8VP:sfTX4zo85w+pa+J8f

    Score
    1/10
    behavioral10behavioral9

MITRE ATT&CK Enterprise v15

Tasks