Overview

overview

10

Static

static

3

2f9f26166b...18.exe

windows7-x64

10

2f9f26166b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f9f26166bb456942e79654907de7348_JaffaCakes118

  • Size

    662KB

  • Sample

    240510-r2kc1abb2s

  • MD5

    2f9f26166bb456942e79654907de7348

  • SHA1

    566d979808725946b4f49afa65a5acb7687710f1

  • SHA256

    0ecddc255ca3517a912462157180e31ac28f0623bfd6cf7ecb83d2f8deba3a8b

  • SHA512

    9da9613744d624a4b3173ed1f585f652053fbd5a996098a87f9ab3c9d1a155e061eef072f1c2a0c4ea8b3be5cb28f69dd4527bd07ad955b7b6338790c19167b5

  • SSDEEP

    3072:HVx1gIFYylLCtuNA86S+3wO0uOxh1AUfbMNrM9QnyU0Vqavk22qcpkBvjiaO8Ae4:H31gcNDDpunyUb/pWjiAJRy9Nf

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://shakealars3.com/Grace9/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      2f9f26166bb456942e79654907de7348_JaffaCakes118

    • Size

      662KB

    • MD5

      2f9f26166bb456942e79654907de7348

    • SHA1

      566d979808725946b4f49afa65a5acb7687710f1

    • SHA256

      0ecddc255ca3517a912462157180e31ac28f0623bfd6cf7ecb83d2f8deba3a8b

    • SHA512

      9da9613744d624a4b3173ed1f585f652053fbd5a996098a87f9ab3c9d1a155e061eef072f1c2a0c4ea8b3be5cb28f69dd4527bd07ad955b7b6338790c19167b5

    • SSDEEP

      3072:HVx1gIFYylLCtuNA86S+3wO0uOxh1AUfbMNrM9QnyU0Vqavk22qcpkBvjiaO8Ae4:H31gcNDDpunyUb/pWjiAJRy9Nf

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks