General

  • Target

    9fe0570084fb1c85501172f7a734f6a6_JaffaCakes118

  • Size

    104KB

  • Sample

    240612-h51dystglc

  • MD5

    9fe0570084fb1c85501172f7a734f6a6

  • SHA1

    c62ac3bf691d167c2fa87283aba06df26a1421c1

  • SHA256

    327f65b7a6a5c0ec9a398c7f4ab74913fde22e78203cf03e117f7c72998bc038

  • SHA512

    33b62dabac1b431b040f2d8790fcf0bd0fc600fd64901bed1472db526c3a0e4128f8ec139e9d775798104209132df035b5468d6600e1fb1fd8ac899a101a9dda

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

Malware Config

Extracted

Family

lokibot

C2

http://erxst.info/ret/four/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      9fe0570084fb1c85501172f7a734f6a6_JaffaCakes118

    • Size

      104KB

    • MD5

      9fe0570084fb1c85501172f7a734f6a6

    • SHA1

      c62ac3bf691d167c2fa87283aba06df26a1421c1

    • SHA256

      327f65b7a6a5c0ec9a398c7f4ab74913fde22e78203cf03e117f7c72998bc038

    • SHA512

      33b62dabac1b431b040f2d8790fcf0bd0fc600fd64901bed1472db526c3a0e4128f8ec139e9d775798104209132df035b5468d6600e1fb1fd8ac899a101a9dda

    • SSDEEP

      1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v15

Tasks