General

  • Target

    3c3cedc000a25a9478e78e2a90b3310afec83616d36f9353be0721dd2aa052f8

  • Size

    990KB

  • Sample

    240510-jwm8psbh2x

  • MD5

    53a01fab9569531fc1003d2c311c3be5

  • SHA1

    2a06e0d33e8eeb5de3f2871966fd79d881291edf

  • SHA256

    3c3cedc000a25a9478e78e2a90b3310afec83616d36f9353be0721dd2aa052f8

  • SHA512

    6f1b53eed342ff6855f4f9f2aa32fdf8d7fb00aaff5f11eab945fb8132b246e22e341eb659ff5442fddcdfcfd50d80ca6f6b8096519ceb97b378b1b7d5e9494b

  • SSDEEP

    24576:rxlH0Rs/lye+jfbqgevz5thlMRNuPraFOPSKa0:dlH0Rs/z+7bqllthlMRNuPraFOPSK

Malware Config

Extracted

Family

lokibot

C2

http://195.123.211.210/evie1/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      3c3cedc000a25a9478e78e2a90b3310afec83616d36f9353be0721dd2aa052f8

    • Size

      990KB

    • MD5

      53a01fab9569531fc1003d2c311c3be5

    • SHA1

      2a06e0d33e8eeb5de3f2871966fd79d881291edf

    • SHA256

      3c3cedc000a25a9478e78e2a90b3310afec83616d36f9353be0721dd2aa052f8

    • SHA512

      6f1b53eed342ff6855f4f9f2aa32fdf8d7fb00aaff5f11eab945fb8132b246e22e341eb659ff5442fddcdfcfd50d80ca6f6b8096519ceb97b378b1b7d5e9494b

    • SSDEEP

      24576:rxlH0Rs/lye+jfbqgevz5thlMRNuPraFOPSKa0:dlH0Rs/z+7bqllthlMRNuPraFOPSK

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks