Overview

overview

10

Static

static

1

5bd8073eb6...18.rtf

windows7-x64

10

5bd8073eb6...18.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5bd8073eb6ee3b48ed4be6e769f8b6e0_JaffaCakes118

  • Size

    534KB

  • Sample

    240519-2j8b8aee39

  • MD5

    5bd8073eb6ee3b48ed4be6e769f8b6e0

  • SHA1

    5906720656c80e96d3e35eeaaf48dbdc25236a7f

  • SHA256

    d0919e2ea93d45755adec371d67a2c042a25a475c3f531b92d59d0270e8505e4

  • SHA512

    6d8443b9a5d7b483ef8052b0de536483bfda875e1915d3c32d77d4b2bf1495768df28d54aa81cb391f4cb7ce74e3ded266166edc97abe60d82eb20fe287fb3b1

  • SSDEEP

    12288:Hzcp3YHI+3q0vR7JZIibtiwN9wA3j+qeXA3JJkf+/u9ZGFQ:HrHh3qgJj1Nx3ypXG/4P

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://185.24.233.117/~zadmin/frb/cache.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      5bd8073eb6ee3b48ed4be6e769f8b6e0_JaffaCakes118

    • Size

      534KB

    • MD5

      5bd8073eb6ee3b48ed4be6e769f8b6e0

    • SHA1

      5906720656c80e96d3e35eeaaf48dbdc25236a7f

    • SHA256

      d0919e2ea93d45755adec371d67a2c042a25a475c3f531b92d59d0270e8505e4

    • SHA512

      6d8443b9a5d7b483ef8052b0de536483bfda875e1915d3c32d77d4b2bf1495768df28d54aa81cb391f4cb7ce74e3ded266166edc97abe60d82eb20fe287fb3b1

    • SSDEEP

      12288:Hzcp3YHI+3q0vR7JZIibtiwN9wA3j+qeXA3JJkf+/u9ZGFQ:HrHh3qgJj1Nx3ypXG/4P

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks