General

  • Target

    cb311433fa1c8d6e80cbb8e13bc1af80c1a5c6ffbc10d28096671b5188f8b835

  • Size

    104KB

  • Sample

    240825-f8r6msxcle

  • MD5

    46e14dc04ccfe824f67fa6eb57edd38a

  • SHA1

    74481772cc6c62a20a1ea2ddc7d8b2ff6eeae9b5

  • SHA256

    cb311433fa1c8d6e80cbb8e13bc1af80c1a5c6ffbc10d28096671b5188f8b835

  • SHA512

    49f07edbf81a9bf6248a9eadc7110256cd60784f220664cfb634f4ef79d609de2d390b10dd48e678f31193fa3618c8b5fb875f083a0c95028559b40e15a2b9a2

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

Malware Config

Extracted

Family

lokibot

C2

http://91.243.80.67/ddx/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      cb311433fa1c8d6e80cbb8e13bc1af80c1a5c6ffbc10d28096671b5188f8b835

    • Size

      104KB

    • MD5

      46e14dc04ccfe824f67fa6eb57edd38a

    • SHA1

      74481772cc6c62a20a1ea2ddc7d8b2ff6eeae9b5

    • SHA256

      cb311433fa1c8d6e80cbb8e13bc1af80c1a5c6ffbc10d28096671b5188f8b835

    • SHA512

      49f07edbf81a9bf6248a9eadc7110256cd60784f220664cfb634f4ef79d609de2d390b10dd48e678f31193fa3618c8b5fb875f083a0c95028559b40e15a2b9a2

    • SSDEEP

      1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v15

Tasks