Overview

overview

10

Static

static

3

2559b5b8d6...18.exe

windows7-x64

10

2559b5b8d6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2559b5b8d60dd663df52d0570f5973a9_JaffaCakes118

  • Size

    263KB

  • Sample

    240704-kvrp6svhmf

  • MD5

    2559b5b8d60dd663df52d0570f5973a9

  • SHA1

    2af0e521c34cf7eaae8677e593900024fe0d16c9

  • SHA256

    77efe5a35f94f065b20860f7e446432d9c61fd6b139b1f4cd360a5a728f49410

  • SHA512

    eafd4add02278ee7c827a8ee21827d47adcafca0d29f1cfac2de5dc6ddd734ba4c3b74a50da6c977af84dec72498ee4642da6328459ac659ca84c8cd5f69e669

  • SSDEEP

    6144:T1wUIRkrbJzmFuERDOm+dwclg+8Iy+8Cl9Tf6BxUemJ:T1ORkr1CFuERD9+yb+R8k9TS79mJ

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://becharnise.ir/fa13/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      2559b5b8d60dd663df52d0570f5973a9_JaffaCakes118

    • Size

      263KB

    • MD5

      2559b5b8d60dd663df52d0570f5973a9

    • SHA1

      2af0e521c34cf7eaae8677e593900024fe0d16c9

    • SHA256

      77efe5a35f94f065b20860f7e446432d9c61fd6b139b1f4cd360a5a728f49410

    • SHA512

      eafd4add02278ee7c827a8ee21827d47adcafca0d29f1cfac2de5dc6ddd734ba4c3b74a50da6c977af84dec72498ee4642da6328459ac659ca84c8cd5f69e669

    • SSDEEP

      6144:T1wUIRkrbJzmFuERDOm+dwclg+8Iy+8Cl9Tf6BxUemJ:T1ORkr1CFuERD9+yb+R8k9TS79mJ

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks