General
-
Target
MV XH DOLPHINPDF.exe
-
Size
940KB
-
Sample
240527-back3sad6x
-
MD5
e3d3d93759a0552c63ec2c3ccbf6c383
-
SHA1
cfa0d6279822bc75a22e54e3dcb6e378a0772605
-
SHA256
31607008c03354cf7b6b21d8d3ecc31186e39a92dca54c0c26c30ecd85957cec
-
SHA512
a907954c0554dfa1f20f87e1c71e32f65276197672065d321b249fba96662b7ab853e12a67482d2c860213d63ab76ead7b69bb89c19931bc2fcca7dbbf83e8c7
-
SSDEEP
24576:sAHnh+eWsN3skA4RV1Hom2KXMmHaIEUS6WH5:Lh+ZkldoPK8YaIEUjq
Malware Config
Extracted
lokibot
https://edgewell.cam/DV2/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
MV XH DOLPHINPDF.exe
-
Size
940KB
-
MD5
e3d3d93759a0552c63ec2c3ccbf6c383
-
SHA1
cfa0d6279822bc75a22e54e3dcb6e378a0772605
-
SHA256
31607008c03354cf7b6b21d8d3ecc31186e39a92dca54c0c26c30ecd85957cec
-
SHA512
a907954c0554dfa1f20f87e1c71e32f65276197672065d321b249fba96662b7ab853e12a67482d2c860213d63ab76ead7b69bb89c19931bc2fcca7dbbf83e8c7
-
SSDEEP
24576:sAHnh+eWsN3skA4RV1Hom2KXMmHaIEUS6WH5:Lh+ZkldoPK8YaIEUjq
Score10/10-
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-