Overview

overview

10

Static

static

3

62337a5348...18.exe

windows7-x64

10

62337a5348...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    62337a5348b9eab53894b51e0beaa776_JaffaCakes118

  • Size

    436KB

  • Sample

    240521-gazcqsdb98

  • MD5

    62337a5348b9eab53894b51e0beaa776

  • SHA1

    9cee8356846b1c904c2984aa76c3cd6a1452db1c

  • SHA256

    f87a8392f0acfa3a06a7ac6c6591966833a414e7f2a54301ae03b9cd02f5b84e

  • SHA512

    b84ebbf306f2a7adb37d7747f4175d9e3819e900ce53fac6709d6ab10cba60f2b356677e27343abe78a1b39e7c972dab36f8e7164e41b96ba368d6e0440f3316

  • SSDEEP

    12288:HKon3x71M86NdQJrIZin7sG/quADfGjgYCuIA48mymZvW:HXnx14QYiAG/quA+jzIA480Z

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://blazinghotter.igg.biz/wp/wp-content/cgi/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      62337a5348b9eab53894b51e0beaa776_JaffaCakes118

    • Size

      436KB

    • MD5

      62337a5348b9eab53894b51e0beaa776

    • SHA1

      9cee8356846b1c904c2984aa76c3cd6a1452db1c

    • SHA256

      f87a8392f0acfa3a06a7ac6c6591966833a414e7f2a54301ae03b9cd02f5b84e

    • SHA512

      b84ebbf306f2a7adb37d7747f4175d9e3819e900ce53fac6709d6ab10cba60f2b356677e27343abe78a1b39e7c972dab36f8e7164e41b96ba368d6e0440f3316

    • SSDEEP

      12288:HKon3x71M86NdQJrIZin7sG/quADfGjgYCuIA48mymZvW:HXnx14QYiAG/quA+jzIA480Z

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks