Overview

overview

10

Static

static

3

80deb4864d...18.exe

windows7-x64

10

80deb4864d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    80deb4864d3e01ae76b938925eabe622_JaffaCakes118

  • Size

    289KB

  • Sample

    240801-r16jvazdna

  • MD5

    80deb4864d3e01ae76b938925eabe622

  • SHA1

    611d4557ac5d499afb7445ecf396f6560474e8ea

  • SHA256

    f50897115f10331d6e9d08e5366e7f60d743a49edc550d1b087735733e36c9f7

  • SHA512

    9ca71aa0713c85a2394d1f5cb91e9753e5488057f5e9d1b701f60fbb40653354b7c39eee9ac018e3c0be4b794e901a9542bdfddd510dac69f976d4b10caee3a0

  • SSDEEP

    6144:YPWe8L7O132mpFNoq2Jc22ROhxxpeTr/ekI:De8fO133kqeLDzxp6L

Score
10/10
lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://checkvim.com/ga15/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      80deb4864d3e01ae76b938925eabe622_JaffaCakes118

    • Size

      289KB

    • MD5

      80deb4864d3e01ae76b938925eabe622

    • SHA1

      611d4557ac5d499afb7445ecf396f6560474e8ea

    • SHA256

      f50897115f10331d6e9d08e5366e7f60d743a49edc550d1b087735733e36c9f7

    • SHA512

      9ca71aa0713c85a2394d1f5cb91e9753e5488057f5e9d1b701f60fbb40653354b7c39eee9ac018e3c0be4b794e901a9542bdfddd510dac69f976d4b10caee3a0

    • SSDEEP

      6144:YPWe8L7O132mpFNoq2Jc22ROhxxpeTr/ekI:De8fO133kqeLDzxp6L

    Score
    10/10
    lokibotcollectioncredential_accessspywarestealertrojandiscovery

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks