Overview

overview

10

Static

static

3

57b0d2422b...18.exe

windows7-x64

10

57b0d2422b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    57b0d2422b4b0433fc06febddb4d3f02_JaffaCakes118

  • Size

    593KB

  • Sample

    240718-rb33es1gqq

  • MD5

    57b0d2422b4b0433fc06febddb4d3f02

  • SHA1

    c333cae99c01f39085ca2f92cc23c22649294a37

  • SHA256

    51ff782755f2cee68565d550be791641ed77015f1d58455a3adb9584b1189922

  • SHA512

    0e3f4713bac71f8d461490581140876ca1fad5a4f8e63ed7ada69793ad558afc7ad477a77112e62aa3293185a0d7f829d974066e5a76cabf6bd43fb79b50eef0

  • SSDEEP

    12288:xsUML1/s5tVs5NApy6EUowkbTQH4DAkeERp:qzLimARZsTQDf+

Score
10/10
lokibotcollectionspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://mecharnise.ir/da19/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      57b0d2422b4b0433fc06febddb4d3f02_JaffaCakes118

    • Size

      593KB

    • MD5

      57b0d2422b4b0433fc06febddb4d3f02

    • SHA1

      c333cae99c01f39085ca2f92cc23c22649294a37

    • SHA256

      51ff782755f2cee68565d550be791641ed77015f1d58455a3adb9584b1189922

    • SHA512

      0e3f4713bac71f8d461490581140876ca1fad5a4f8e63ed7ada69793ad558afc7ad477a77112e62aa3293185a0d7f829d974066e5a76cabf6bd43fb79b50eef0

    • SSDEEP

      12288:xsUML1/s5tVs5NApy6EUowkbTQH4DAkeERp:qzLimARZsTQDf+

    Score
    10/10
    lokibotcollectionspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks