lokibot | 30d67e1fd74815d843fcb8a6f5080efdfd52e757c4e2b946ead78d683320cbe9

General

Target

684b0b38612c2053780220f895d724a3_JaffaCakes118
Size

336KB
Sample

240522-xqjj8ada84
MD5

684b0b38612c2053780220f895d724a3
SHA1

1b0376f07f7f6074ea53b97feabc0c13f6acbdc1
SHA256

30d67e1fd74815d843fcb8a6f5080efdfd52e757c4e2b946ead78d683320cbe9
SHA512

ebdc61a43723c2ee8acdf48714f22fd17f376d2d5013166bb801e9e7a68b67bd2bb9b04d6dac95a292aee8e1c4d3de2626738f79a16f5cf0fce0f2cfaab5e102
SSDEEP

6144:gi/XCM+znnTkCfhVJNdykL34cd6bUfFdXThUV1wT10pNjYeNc3uETnJ:gi6lnTkCfhVJby7wPXKVuT10pNjYj

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://emas-store.com/wp-includes/js/tinymce/themes/inlite/main/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  684b0b38612c2053780220f895d724a3_JaffaCakes118
- Size
  
  336KB
- MD5
  
  684b0b38612c2053780220f895d724a3
- SHA1
  
  1b0376f07f7f6074ea53b97feabc0c13f6acbdc1
- SHA256
  
  30d67e1fd74815d843fcb8a6f5080efdfd52e757c4e2b946ead78d683320cbe9
- SHA512
  
  ebdc61a43723c2ee8acdf48714f22fd17f376d2d5013166bb801e9e7a68b67bd2bb9b04d6dac95a292aee8e1c4d3de2626738f79a16f5cf0fce0f2cfaab5e102
- SSDEEP
  
  6144:gi/XCM+znnTkCfhVJNdykL34cd6bUfFdXThUV1wT10pNjYeNc3uETnJ:gi6lnTkCfhVJby7wPXKVuT10pNjYj
Score

5^/10

microsoft phishing
- Detected potential entity reuse from brand microsoft.
  phishing microsoft
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detected potential entity reuse from brand microsoft.

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2