lokibot | a64b1c33fbbc54651247b875661bf9861411b8f03896e7fb49ee26f428608f6c

General

Target

3fb496b59249176f1d9713fad1a83330.bin
Size

104KB
Sample

240518-cfajcafb5y
MD5

3fb496b59249176f1d9713fad1a83330
SHA1

c4b113cbfac0995c0d59ee4d5313cc0ccecae76d
SHA256

a64b1c33fbbc54651247b875661bf9861411b8f03896e7fb49ee26f428608f6c
SHA512

005aa8eda55a64b438e2b9a2f5e17f4c1b52c51161a31e8127fe85bbf6634b9c2bb75aa6ab417f7b61b954193b51bca5427f65713fa0fba2194fde1ea45488e0
SSDEEP

1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqxIzmd:nSHIG6mQwGmfOQd8YhY0/E8UG

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://en.mg-trade.ir/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  3fb496b59249176f1d9713fad1a83330.bin
- Size
  
  104KB
- MD5
  
  3fb496b59249176f1d9713fad1a83330
- SHA1
  
  c4b113cbfac0995c0d59ee4d5313cc0ccecae76d
- SHA256
  
  a64b1c33fbbc54651247b875661bf9861411b8f03896e7fb49ee26f428608f6c
- SHA512
  
  005aa8eda55a64b438e2b9a2f5e17f4c1b52c51161a31e8127fe85bbf6634b9c2bb75aa6ab417f7b61b954193b51bca5427f65713fa0fba2194fde1ea45488e0
- SSDEEP
  
  1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqxIzmd:nSHIG6mQwGmfOQd8YhY0/E8UG
Score

7^/10

spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2