Overview

overview

10

Static

static

3

c51f026c9d...18.exe

windows7-x64

10

c51f026c9d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c51f026c9d7e33819a7316931486f61f_JaffaCakes118

  • Size

    456KB

  • Sample

    240827-q6c9tatema

  • MD5

    c51f026c9d7e33819a7316931486f61f

  • SHA1

    603e3138e0b5737adccc73a576812f2610e744dc

  • SHA256

    55a48d18d84f9c95d24fa263972e320b32cda84247bf0e4fa505f138033ec4f3

  • SHA512

    519fa21a5732c5a93cc54be65bf0c017f0e075e175fa23a96ff3423907adae1ecaa1185050a2ac11f10e1e193e375ce667312828c59c36c03b147764862c3b6e

  • SSDEEP

    6144:qtQZqm15Jt86dy5yZ8cqqNyBdlRSz3wUev2Gw:qtsu6dTqxzG3ce

Score
10/10
lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://umarguzardijye.com/work/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      c51f026c9d7e33819a7316931486f61f_JaffaCakes118

    • Size

      456KB

    • MD5

      c51f026c9d7e33819a7316931486f61f

    • SHA1

      603e3138e0b5737adccc73a576812f2610e744dc

    • SHA256

      55a48d18d84f9c95d24fa263972e320b32cda84247bf0e4fa505f138033ec4f3

    • SHA512

      519fa21a5732c5a93cc54be65bf0c017f0e075e175fa23a96ff3423907adae1ecaa1185050a2ac11f10e1e193e375ce667312828c59c36c03b147764862c3b6e

    • SSDEEP

      6144:qtQZqm15Jt86dy5yZ8cqqNyBdlRSz3wUev2Gw:qtsu6dTqxzG3ce

    Score
    10/10
    lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks