General

  • Target

    98a374b7acd39cf3e785ef5d31743e88_JaffaCakes118

  • Size

    295KB

  • Sample

    240815-c81w1awbln

  • MD5

    98a374b7acd39cf3e785ef5d31743e88

  • SHA1

    8b58fd7f66b15c48c87c6228e1bf6888c5349372

  • SHA256

    41f37d08fe0ebacaa087bdcb4f78a57752bb39e5bfd7399b9dc680977d855691

  • SHA512

    c9fd30288bd8e9a5617123e77c492316cca5d270b215c11414b4ab6168fb7961ada568d2a7c481db7b69e50d61064ccb436b99806748f02c1a00142f77ebb3bd

  • SSDEEP

    6144:o7R7fq2ByuEleJhurSNU3HmaGwwC1D6Y6ScCT4s9ohvLauDFaM:MfPkXQJhurSNU2FwwC1WD7ax

Malware Config

Extracted

Family

lokibot

C2

http://becharnise.ir/fb2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      98a374b7acd39cf3e785ef5d31743e88_JaffaCakes118

    • Size

      295KB

    • MD5

      98a374b7acd39cf3e785ef5d31743e88

    • SHA1

      8b58fd7f66b15c48c87c6228e1bf6888c5349372

    • SHA256

      41f37d08fe0ebacaa087bdcb4f78a57752bb39e5bfd7399b9dc680977d855691

    • SHA512

      c9fd30288bd8e9a5617123e77c492316cca5d270b215c11414b4ab6168fb7961ada568d2a7c481db7b69e50d61064ccb436b99806748f02c1a00142f77ebb3bd

    • SSDEEP

      6144:o7R7fq2ByuEleJhurSNU3HmaGwwC1D6Y6ScCT4s9ohvLauDFaM:MfPkXQJhurSNU2FwwC1WD7ax

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v15

Tasks