General

  • Target

    9d3c09a029f889e449d2abc0aab29fde_JaffaCakes118

  • Size

    279KB

  • Sample

    240816-gxkg4atdnn

  • MD5

    9d3c09a029f889e449d2abc0aab29fde

  • SHA1

    6292b1cdf3cca3028699598041f557073f1961c8

  • SHA256

    4f020bad002a120bfe99665029e7f612f0278d4e2d548fc437201e5ac3372a86

  • SHA512

    8c84c15604946572f1f6598553d5e1d1198cab783788214e06bf59b35715aa8088fe001cbc020aff290294015788b5136e9c6cada68f770420f4e5e9d48f998b

  • SSDEEP

    6144:maDzULO+XXEyULkVRJzxiSETX6JgMqgyzROhxxpeTr/ekI:hDg9XXEKdiTSqgbzxp6L

Malware Config

Extracted

Family

lokibot

C2

http://checkvim.com/ga15/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      9d3c09a029f889e449d2abc0aab29fde_JaffaCakes118

    • Size

      279KB

    • MD5

      9d3c09a029f889e449d2abc0aab29fde

    • SHA1

      6292b1cdf3cca3028699598041f557073f1961c8

    • SHA256

      4f020bad002a120bfe99665029e7f612f0278d4e2d548fc437201e5ac3372a86

    • SHA512

      8c84c15604946572f1f6598553d5e1d1198cab783788214e06bf59b35715aa8088fe001cbc020aff290294015788b5136e9c6cada68f770420f4e5e9d48f998b

    • SSDEEP

      6144:maDzULO+XXEyULkVRJzxiSETX6JgMqgyzROhxxpeTr/ekI:hDg9XXEKdiTSqgbzxp6L

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v15

Tasks