Overview

overview

10

Static

static

3

442add686c...18.exe

windows7-x64

10

442add686c...18.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    442add686cd63f2657bbb8baae88330b_JaffaCakes118

  • Size

    679KB

  • Sample

    240515-cwat2sdc36

  • MD5

    442add686cd63f2657bbb8baae88330b

  • SHA1

    e8509a9a616992b9b96f7cad6fd4992b64b8eb72

  • SHA256

    5d2fbcd8887f246b09b80bf59a29137ba43e05f7651bf173bae9bdb88da4a21d

  • SHA512

    02781ef3e6d83a50efdae2dafb6413d5d5335f4654555da345356b46809ea89fa7f0d661b371882ad617ad072583efda2e4fc36a1609cb3dd9f4a97329f99c43

  • SSDEEP

    12288:/Q2Wmzqwk8LaUjYDyFWCu3SDIIRIiuYQi01FvMMs9xL:/QLeqwk8LaDyF7DIIRIizQ1pI9x

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://opulenttraesures.com/fertyop/loutyo/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      442add686cd63f2657bbb8baae88330b_JaffaCakes118

    • Size

      679KB

    • MD5

      442add686cd63f2657bbb8baae88330b

    • SHA1

      e8509a9a616992b9b96f7cad6fd4992b64b8eb72

    • SHA256

      5d2fbcd8887f246b09b80bf59a29137ba43e05f7651bf173bae9bdb88da4a21d

    • SHA512

      02781ef3e6d83a50efdae2dafb6413d5d5335f4654555da345356b46809ea89fa7f0d661b371882ad617ad072583efda2e4fc36a1609cb3dd9f4a97329f99c43

    • SSDEEP

      12288:/Q2Wmzqwk8LaUjYDyFWCu3SDIIRIiuYQi01FvMMs9xL:/QLeqwk8LaDyF7DIIRIizQ1pI9x

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks