Overview

overview

10

Static

static

3

d3f5241b4b...18.exe

windows7-x64

10

d3f5241b4b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d3f5241b4be888828c7103fa4a656900_JaffaCakes118

  • Size

    633KB

  • Sample

    240908-kg6beawdkn

  • MD5

    d3f5241b4be888828c7103fa4a656900

  • SHA1

    edef77583fde892a821c79761678aa98ba38a1d9

  • SHA256

    44a69c7c5d2d361fc5a505d982cca194b55a8647a8555dfddc3543e7cfd4a315

  • SHA512

    14d5cf6a20101f5e44b16fb83e91c70a06f402fee9ea1364fa34c20163c9e45c6ea19c8afb5dd2c357018ebd2f298ef19f4b85f24198560dc9fcbf1075a6118e

  • SSDEEP

    12288:DcfCKLV8eCewydWuSoI9/SMwGoMsXz2KOzUZbym:4tp3CD9uSogXwmsjdeuym

Score
10/10
lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://37.72.168.228/dusk/hond/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      d3f5241b4be888828c7103fa4a656900_JaffaCakes118

    • Size

      633KB

    • MD5

      d3f5241b4be888828c7103fa4a656900

    • SHA1

      edef77583fde892a821c79761678aa98ba38a1d9

    • SHA256

      44a69c7c5d2d361fc5a505d982cca194b55a8647a8555dfddc3543e7cfd4a315

    • SHA512

      14d5cf6a20101f5e44b16fb83e91c70a06f402fee9ea1364fa34c20163c9e45c6ea19c8afb5dd2c357018ebd2f298ef19f4b85f24198560dc9fcbf1075a6118e

    • SSDEEP

      12288:DcfCKLV8eCewydWuSoI9/SMwGoMsXz2KOzUZbym:4tp3CD9uSogXwmsjdeuym

    Score
    10/10
    lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks