General

  • Target

    75db65df801529027b4884cb69ad85fa_JaffaCakes118

  • Size

    104KB

  • Sample

    240726-1ngjmawhkp

  • MD5

    75db65df801529027b4884cb69ad85fa

  • SHA1

    d4dbb10f5b8f9fd47647a7db5b90c1e8c2208a2c

  • SHA256

    b10eea964752defb636667f3cd4641f1f8b5f3285ba583d4ed92868719c4d785

  • SHA512

    8df56c19c65a4e8fdb75614f81f3735f18cf2b9d4ea38c388e5170f7cbc0b10b2e584a50e82319f4ceb9f3fdbf6eb9905feb1dc4527d16d9daf62ae8be33c06e

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

Malware Config

Extracted

Family

lokibot

C2

http://becharnise.ir/fox/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      75db65df801529027b4884cb69ad85fa_JaffaCakes118

    • Size

      104KB

    • MD5

      75db65df801529027b4884cb69ad85fa

    • SHA1

      d4dbb10f5b8f9fd47647a7db5b90c1e8c2208a2c

    • SHA256

      b10eea964752defb636667f3cd4641f1f8b5f3285ba583d4ed92868719c4d785

    • SHA512

      8df56c19c65a4e8fdb75614f81f3735f18cf2b9d4ea38c388e5170f7cbc0b10b2e584a50e82319f4ceb9f3fdbf6eb9905feb1dc4527d16d9daf62ae8be33c06e

    • SSDEEP

      1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v15

Tasks