Overview

overview

10

Static

static

10

7f01c01429...18.exe

windows7-x64

10

7f01c01429...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7f01c01429bbf68906f829f8bd515f30_JaffaCakes118

  • Size

    133KB

  • Sample

    240529-bb4e7abf7v

  • MD5

    7f01c01429bbf68906f829f8bd515f30

  • SHA1

    399ee9827ca57734b85a17f99e78187acf1837f2

  • SHA256

    08b735747638f557d1236a57e44fc25470c2f63ddd1c94954e047a41f2dd3b9b

  • SHA512

    1e47f48f806d8f28404ba416ec55a5a28160f187fc98a7c61684f8d222375ba65283cb5da995c879c83c0151780048b6c1ca6ef3d4149d9bd6277ac4c10d3037

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd+YTjipvF2a:nSHIG6mQwGmfOQd8YhY0/EqUG+YvQd2a

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

https://mnbvcxz.biz/oj/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      7f01c01429bbf68906f829f8bd515f30_JaffaCakes118

    • Size

      133KB

    • MD5

      7f01c01429bbf68906f829f8bd515f30

    • SHA1

      399ee9827ca57734b85a17f99e78187acf1837f2

    • SHA256

      08b735747638f557d1236a57e44fc25470c2f63ddd1c94954e047a41f2dd3b9b

    • SHA512

      1e47f48f806d8f28404ba416ec55a5a28160f187fc98a7c61684f8d222375ba65283cb5da995c879c83c0151780048b6c1ca6ef3d4149d9bd6277ac4c10d3037

    • SSDEEP

      1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd+YTjipvF2a:nSHIG6mQwGmfOQd8YhY0/EqUG+YvQd2a

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks