Overview

overview

10

Static

static

3

52ba48a8c9...18.exe

windows7-x64

10

52ba48a8c9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    52ba48a8c9b99a348f5d90759aa3420c_JaffaCakes118

  • Size

    672KB

  • Sample

    240717-m9ys5sxhpm

  • MD5

    52ba48a8c9b99a348f5d90759aa3420c

  • SHA1

    50a7b31d2dc772cb27f892610414632621209c5d

  • SHA256

    280a8af8fb903d9c9a2f6f65e8913aef055578957e436cf62cba7c2c5ebc1096

  • SHA512

    38beee1dcce2ec34c76a5f8e7d1ab3720e08fe60b3988efe26ac0a29badf1f93e599f35656750f975e60e92beab6b216ec87e86c76b8f16a28a0897c249445c5

  • SSDEEP

    12288:Xp7fsXSPbG1PfRLH1PZ8s8E+RWPX02NdGyY:ZoiPb2RLHEpWPXjNdGy

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://flbertex.com/ob/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      52ba48a8c9b99a348f5d90759aa3420c_JaffaCakes118

    • Size

      672KB

    • MD5

      52ba48a8c9b99a348f5d90759aa3420c

    • SHA1

      50a7b31d2dc772cb27f892610414632621209c5d

    • SHA256

      280a8af8fb903d9c9a2f6f65e8913aef055578957e436cf62cba7c2c5ebc1096

    • SHA512

      38beee1dcce2ec34c76a5f8e7d1ab3720e08fe60b3988efe26ac0a29badf1f93e599f35656750f975e60e92beab6b216ec87e86c76b8f16a28a0897c249445c5

    • SSDEEP

      12288:Xp7fsXSPbG1PfRLH1PZ8s8E+RWPX02NdGyY:ZoiPb2RLHEpWPXjNdGy

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks