Overview

overview

10

Static

static

10

Payment In...00.exe

windows7-x64

10

Payment In...00.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    292efe0145708519a7a6a65614a275c5_JaffaCakes118

  • Size

    44KB

  • Sample

    240706-w5fw7s1gmf

  • MD5

    292efe0145708519a7a6a65614a275c5

  • SHA1

    aebb30aeb06e1a9d475e02b3deb3ef1c9c05c788

  • SHA256

    3f3cfdde2b2c77c77934e6ccde111024421fbe2e2c9f973a840960f5de59a056

  • SHA512

    13e42ef93ceb097c74dabc8553824f5b93bfc8201db0f9391f8ce0f7267a6b840ac8660f9e2e3dbea1d327a818f1a1b691655ec15846e6a6b7e7ba0835874582

  • SSDEEP

    768:iYyyaN2wbTNNKRPeP+fvfOwg4hJoqTkb2ieWc+Y8ZTZ98e4KQQv4mkTVp5/Bs0uY:uyaN2wbqRG+fOwr2YvOYwZ2e4PQdCB4Y

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://becharnise.ir/fox/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      Payment Instruction$94569.00.exe

    • Size

      104KB

    • MD5

      75db65df801529027b4884cb69ad85fa

    • SHA1

      d4dbb10f5b8f9fd47647a7db5b90c1e8c2208a2c

    • SHA256

      b10eea964752defb636667f3cd4641f1f8b5f3285ba583d4ed92868719c4d785

    • SHA512

      8df56c19c65a4e8fdb75614f81f3735f18cf2b9d4ea38c388e5170f7cbc0b10b2e584a50e82319f4ceb9f3fdbf6eb9905feb1dc4527d16d9daf62ae8be33c06e

    • SSDEEP

      1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks