lokibot

General

Target

2e10d027cf069d30831476ed6dd76106_JaffaCakes118
Size

256KB
Sample

240510-jka41aba31
MD5

2e10d027cf069d30831476ed6dd76106
SHA1

77ba4987d1dd520cc231eb822e056dc8406c402b
SHA256

55607c427c329612e4a3407fca35483b949fc3647f60d083389996d533a77bc7
SHA512

967e1bf06603df7d7000089f9437a629dcd170890c071b27687a199c56e58c632d384c6f764e5970c8011dee080d8474e600be5e40e3de3e8d65d4bbccf1bfdf
SSDEEP

6144:4ovtAMGoVoQs82YxKvc2WTYM34DGb0sOcZcfnfrskVRA6l:4mt7GvQoYxoGb0sbZcfwQO6

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://46.166.133.164/0x22/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  2e10d027cf069d30831476ed6dd76106_JaffaCakes118
- Size
  
  256KB
- MD5
  
  2e10d027cf069d30831476ed6dd76106
- SHA1
  
  77ba4987d1dd520cc231eb822e056dc8406c402b
- SHA256
  
  55607c427c329612e4a3407fca35483b949fc3647f60d083389996d533a77bc7
- SHA512
  
  967e1bf06603df7d7000089f9437a629dcd170890c071b27687a199c56e58c632d384c6f764e5970c8011dee080d8474e600be5e40e3de3e8d65d4bbccf1bfdf
- SSDEEP
  
  6144:4ovtAMGoVoQs82YxKvc2WTYM34DGb0sOcZcfnfrskVRA6l:4mt7GvQoYxoGb0sbZcfwQO6
Score

10^/10

lokibot zgrat agilenet collection rat spyware stealer trojan
- Detect ZGRat V1
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect ZGRat V1

ZGRat

Obfuscated with Agile.Net obfuscator

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2