Overview

overview

10

Static

static

3

47f73b541c...18.exe

windows7-x64

1

47f73b541c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    47f73b541c0bb1950fba158136881eec_JaffaCakes118

  • Size

    871KB

  • Sample

    240715-dpxkxavgpm

  • MD5

    47f73b541c0bb1950fba158136881eec

  • SHA1

    d395e1f33c689c35107fc2dc2c3e82f048ba2a37

  • SHA256

    e2e5d2cb61ec3f3f01e17ac8dff23a4e1cbfd9059e9b58646e68a757a1cc976d

  • SHA512

    301d002428d63d76c74f252a2fd1183de69a7f7cece1448be667fca02831338f64a0cfa7f9211334c2ea8389fe7d16274a3e301fe9bc23bb89ea7aa360e953ea

  • SSDEEP

    12288:F0V3xaSQYl6UGiQ5s3XcVd03NCqV5o/JYL:F0NxaYtGims3MVadCqV54J

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://transcorpoil.com/dumbo/dumbo4/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      47f73b541c0bb1950fba158136881eec_JaffaCakes118

    • Size

      871KB

    • MD5

      47f73b541c0bb1950fba158136881eec

    • SHA1

      d395e1f33c689c35107fc2dc2c3e82f048ba2a37

    • SHA256

      e2e5d2cb61ec3f3f01e17ac8dff23a4e1cbfd9059e9b58646e68a757a1cc976d

    • SHA512

      301d002428d63d76c74f252a2fd1183de69a7f7cece1448be667fca02831338f64a0cfa7f9211334c2ea8389fe7d16274a3e301fe9bc23bb89ea7aa360e953ea

    • SSDEEP

      12288:F0V3xaSQYl6UGiQ5s3XcVd03NCqV5o/JYL:F0NxaYtGims3MVadCqV54J

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks