Overview

overview

10

Static

static

3

69cdd4b211...18.exe

windows7-x64

10

69cdd4b211...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118

  • Size

    395KB

  • Sample

    240523-fl47paee58

  • MD5

    69cdd4b211022ff4c6f152673ae9a187

  • SHA1

    4a0e7e2b4ea24c15fb3a7fb9d474bc95174caa55

  • SHA256

    cb39e6d0e8f98ce1d2ea3be9b320ba32c804d5c428c9057c3dda39533536194c

  • SHA512

    09bb34a2be36c1834edc1e2d03b6d4a7f25fee39e449ddcada6966a5aed56e1ed31c11c42163ad6f25c88b6333deb86e19ce799027e14ca38d8ad1f0d52b015e

  • SSDEEP

    6144:RsmDsQwJM5tUebn2BUgKj1LbWTcX8Jz1CjPKliegZSkY1bVJPijmiaPJRuIhpx:+ML3iLKgcXQzcTKl0atL6jBajJhpx

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://mclhk-net.com/chanelstv/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      69cdd4b211022ff4c6f152673ae9a187_JaffaCakes118

    • Size

      395KB

    • MD5

      69cdd4b211022ff4c6f152673ae9a187

    • SHA1

      4a0e7e2b4ea24c15fb3a7fb9d474bc95174caa55

    • SHA256

      cb39e6d0e8f98ce1d2ea3be9b320ba32c804d5c428c9057c3dda39533536194c

    • SHA512

      09bb34a2be36c1834edc1e2d03b6d4a7f25fee39e449ddcada6966a5aed56e1ed31c11c42163ad6f25c88b6333deb86e19ce799027e14ca38d8ad1f0d52b015e

    • SSDEEP

      6144:RsmDsQwJM5tUebn2BUgKj1LbWTcX8Jz1CjPKliegZSkY1bVJPijmiaPJRuIhpx:+ML3iLKgcXQzcTKl0atL6jBajJhpx

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks