General

  • Target

    8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118

  • Size

    185KB

  • Sample

    240602-z5marsfc4z

  • MD5

    8f746e8f11d34dfb6bca0eccc147df2d

  • SHA1

    2f2b6b1800505f3d357e0aa49c4e9cc054ae161a

  • SHA256

    39ee5de517139fe061acafd45d09fcfc38d732e9abe8d14119f2b05b6ea26111

  • SHA512

    4da6d434dc80711a4e72ebcf529836ff797468414772af38cb35491ec8cf3e13138cfe796a73037569eda9f1770a2c7ddae544a6c29bc6778815239c4021b9f2

  • SSDEEP

    3072:28n9R7/ASx0R/KaiI3otOwkamJsJGSP551cLc6LCZWUjh4XQqx/L79Is4Q2szaKT:28n3r/u/WIyOwka4Cxc5mozDxIs4QPz9

Malware Config

Extracted

Family

lokibot

C2

http://confirmationduck.ooo/sql/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      8f746e8f11d34dfb6bca0eccc147df2d_JaffaCakes118

    • Size

      185KB

    • MD5

      8f746e8f11d34dfb6bca0eccc147df2d

    • SHA1

      2f2b6b1800505f3d357e0aa49c4e9cc054ae161a

    • SHA256

      39ee5de517139fe061acafd45d09fcfc38d732e9abe8d14119f2b05b6ea26111

    • SHA512

      4da6d434dc80711a4e72ebcf529836ff797468414772af38cb35491ec8cf3e13138cfe796a73037569eda9f1770a2c7ddae544a6c29bc6778815239c4021b9f2

    • SSDEEP

      3072:28n9R7/ASx0R/KaiI3otOwkamJsJGSP551cLc6LCZWUjh4XQqx/L79Is4Q2szaKT:28n3r/u/WIyOwka4Cxc5mozDxIs4QPz9

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks