Overview

overview

10

Static

static

3

487bcace9d...18.exe

windows7-x64

10

487bcace9d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    487bcace9d16acb36dc5aa12e55e33c0_JaffaCakes118

  • Size

    845KB

  • Sample

    240515-25myeagh3x

  • MD5

    487bcace9d16acb36dc5aa12e55e33c0

  • SHA1

    ba96656d047644650069fd48705ad29842842df0

  • SHA256

    54bce9cf5fd3db8c05d14145ea5828a6f03ab64b6cece66b16ca133459c204c5

  • SHA512

    387680843ca96eff819618d52f7cd9d8bf1e9972b6b5f1aa731d3eda6543e68f0032f229c2a78de989b90d5437a094d6c47ba8b0349fdc7ab2744edbcf1b5bd9

  • SSDEEP

    12288:P8Mu7Mo5dsAgikf4CoxPrj+esTCmDXrikd63itFtpunDIr:P8NMfAlNPrK2mHiZ3YFt4Ur

Score
10/10
lokibotbootkitcollectionpersistencespywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://zedekus.com.ng/badmood/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      487bcace9d16acb36dc5aa12e55e33c0_JaffaCakes118

    • Size

      845KB

    • MD5

      487bcace9d16acb36dc5aa12e55e33c0

    • SHA1

      ba96656d047644650069fd48705ad29842842df0

    • SHA256

      54bce9cf5fd3db8c05d14145ea5828a6f03ab64b6cece66b16ca133459c204c5

    • SHA512

      387680843ca96eff819618d52f7cd9d8bf1e9972b6b5f1aa731d3eda6543e68f0032f229c2a78de989b90d5437a094d6c47ba8b0349fdc7ab2744edbcf1b5bd9

    • SSDEEP

      12288:P8Mu7Mo5dsAgikf4CoxPrj+esTCmDXrikd63itFtpunDIr:P8NMfAlNPrK2mHiZ3YFt4Ur

    Score
    10/10
    lokibotbootkitcollectionpersistencespywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks