General

  • Target

    d52a5186281da29e0235517f66494574_JaffaCakes118

  • Size

    104KB

  • Sample

    240908-1ykc9sxejr

  • MD5

    d52a5186281da29e0235517f66494574

  • SHA1

    299c006ffcd4c4866f87a6d740e982f9b8f6acfe

  • SHA256

    b936eac2c725e88aa40b1c97d001c594eec522adb73b7a793db3666527e11ddc

  • SHA512

    f6b1ffd83ca117ce401987d7f0ae114f504ecb2d87b3757d843436298bcea3da06f28c69865fb283ebabdac004c0028bfa95d458c2a8c6dd58dacc3b03305810

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

Malware Config

Extracted

Family

lokibot

C2

http://www.mcjessy.com/js/wipjessy/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      d52a5186281da29e0235517f66494574_JaffaCakes118

    • Size

      104KB

    • MD5

      d52a5186281da29e0235517f66494574

    • SHA1

      299c006ffcd4c4866f87a6d740e982f9b8f6acfe

    • SHA256

      b936eac2c725e88aa40b1c97d001c594eec522adb73b7a793db3666527e11ddc

    • SHA512

      f6b1ffd83ca117ce401987d7f0ae114f504ecb2d87b3757d843436298bcea3da06f28c69865fb283ebabdac004c0028bfa95d458c2a8c6dd58dacc3b03305810

    • SSDEEP

      1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v15

Tasks