Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ad2a1ee521d33b206afad5a2dd0d21a2_JaffaCakes118

  • Size

    428KB

  • Sample

    240820-akjxgaxemm

  • MD5

    ad2a1ee521d33b206afad5a2dd0d21a2

  • SHA1

    601af70074c026041f081802d67f04142fd4d0a9

  • SHA256

    bc33270f7affb342c69f3ac752b73257071e99a3925ccd8e6ae9a289416df437

  • SHA512

    e7b5957a74091d3b5c4a6c7b8e955637461d5463c37cb7db160522fa125f9ba90c3508898a0bc598a4a47a8db3b02b4b539f5e9b38fa63eaab300422c85063f0

  • SSDEEP

    12288:PRfN6EeArbvKNvjAcpPYIABWt4CROw8ch4:PqnNsWPxhOw/4

Malware Config

Extracted

Family

lokibot

C2

http://becharnise.ir/fa12/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      PO. pdf.exe

    • Size

      611KB

    • MD5

      26d938e936501c40950dddad234a7e25

    • SHA1

      3b89ab83aef9bfb294f9a83c774533459fb0f6bb

    • SHA256

      3c5b0462854d7115d4e6a6c1e1154ae2bfe6df8245328a6db34d6ebfe77f3e34

    • SHA512

      e99aae5469a053eb323abc644751d4a48c226e3b9cdade588f49030b9c7d1e0cb5b0602690d356fc7e1abc54e56e2e417adbdcd77a0a03cbb91400ba165e6e87

    • SSDEEP

      12288:CWtN6EcUrLpWLvjwcFPYSABWB4CDODFwrltD:CznLkIPRnODirlt

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks