Overview

overview

10

Static

static

1

3c16488c1b...18.rtf

windows7-x64

10

3c16488c1b...18.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3c16488c1bf94c166438cf8b0c493f92_JaffaCakes118

  • Size

    594KB

  • Sample

    240512-z2w1ssbb57

  • MD5

    3c16488c1bf94c166438cf8b0c493f92

  • SHA1

    3b39cadc38e02feaab919515b3e6063d859d4f5f

  • SHA256

    beb0f3fd9e54f1a8318055fdbc6fa22744de40502c808ba7986fad76c888fed6

  • SHA512

    65dc2af01296115d150d8d92154cc9851bdf083fe7ae047bb1d93a9d136f5b5c6b7a1882b09943fa04bf165a71ddf753da0abe27ff5377e4d7aac93bf2d23c6e

  • SSDEEP

    12288:/OkW5XHwxkaJIXNpkcEbSk6Gsgxu99mXDyeZE9naydU3SFTqW5zm:3W5XHakS8gcgSVLyDXC4EUKTqW5C

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://31.220.1.194/~zadmin/eval/mono.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      3c16488c1bf94c166438cf8b0c493f92_JaffaCakes118

    • Size

      594KB

    • MD5

      3c16488c1bf94c166438cf8b0c493f92

    • SHA1

      3b39cadc38e02feaab919515b3e6063d859d4f5f

    • SHA256

      beb0f3fd9e54f1a8318055fdbc6fa22744de40502c808ba7986fad76c888fed6

    • SHA512

      65dc2af01296115d150d8d92154cc9851bdf083fe7ae047bb1d93a9d136f5b5c6b7a1882b09943fa04bf165a71ddf753da0abe27ff5377e4d7aac93bf2d23c6e

    • SSDEEP

      12288:/OkW5XHwxkaJIXNpkcEbSk6Gsgxu99mXDyeZE9naydU3SFTqW5zm:3W5XHakS8gcgSVLyDXC4EUKTqW5C

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks