lokibot | 99a643e662b5bfb5f18446a100a1bb0faabf7f87830d5e6c6d188ae4c0fd03d8

General

Target

ce51b027ca209e7de79bbf037809dcb6_JaffaCakes118
Size

1.0MB
Sample

240906-bn5tsayarj
MD5

ce51b027ca209e7de79bbf037809dcb6
SHA1

1d6f80bb1440bdd0271b42b627b496e9a56a8bda
SHA256

99a643e662b5bfb5f18446a100a1bb0faabf7f87830d5e6c6d188ae4c0fd03d8
SHA512

32b3b25d00768877e6b32eb8cb7e96e4222a62a14caf80bd0c8574ba7cb4740860c7449308a43bd5006df48909daf2f9dac4800b121b0335f759328247c88dfc
SSDEEP

12288:c/VHn6wqm8pfPEkVfIggCl8C6A2+MpUt7FFXPjeIJAjI7HakwPXKz:Clnq9UkqggCl8CfsU9HfjeIJh7H3wXKz

Score

10^/10

lokibot discovery

Malware Config

Extracted

Family

lokibot

C2

http://stmoritz.ga/Chido/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  ce51b027ca209e7de79bbf037809dcb6_JaffaCakes118
- Size
  
  1.0MB
- MD5
  
  ce51b027ca209e7de79bbf037809dcb6
- SHA1
  
  1d6f80bb1440bdd0271b42b627b496e9a56a8bda
- SHA256
  
  99a643e662b5bfb5f18446a100a1bb0faabf7f87830d5e6c6d188ae4c0fd03d8
- SHA512
  
  32b3b25d00768877e6b32eb8cb7e96e4222a62a14caf80bd0c8574ba7cb4740860c7449308a43bd5006df48909daf2f9dac4800b121b0335f759328247c88dfc
- SSDEEP
  
  12288:c/VHn6wqm8pfPEkVfIggCl8C6A2+MpUt7FFXPjeIJAjI7HakwPXKz:Clnq9UkqggCl8CfsU9HfjeIJh7H3wXKz
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2