Overview

overview

10

Static

static

3

d56ff4a6d4...18.exe

windows7-x64

10

d56ff4a6d4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d56ff4a6d4ce7af0380e51f2793d29c6_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240909-bskz6sxerg

  • MD5

    d56ff4a6d4ce7af0380e51f2793d29c6

  • SHA1

    3481d1e6ac01180cb7643422581ef5c601d90057

  • SHA256

    1bd123bea59b295444c107eff6e9b3b3f933422c450151ef0eac2bebaae30098

  • SHA512

    9169e6768883f97875bfcb21b7505d17cb2492054c5ce0e04684fc0a3973512c18d6749415920f86dcef1d6a9fae9a0a8b1ef57de6a9c1dbee4b53d86a53d707

  • SSDEEP

    24576:rrbrYF8rnKMoiXCpegUUToqvKgQBZYRmu2fhkoAGes:rrbHmAC0Evz2

Score
10/10
lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://lidgeys.ru/buch-k/fred.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      d56ff4a6d4ce7af0380e51f2793d29c6_JaffaCakes118

    • Size

      1.1MB

    • MD5

      d56ff4a6d4ce7af0380e51f2793d29c6

    • SHA1

      3481d1e6ac01180cb7643422581ef5c601d90057

    • SHA256

      1bd123bea59b295444c107eff6e9b3b3f933422c450151ef0eac2bebaae30098

    • SHA512

      9169e6768883f97875bfcb21b7505d17cb2492054c5ce0e04684fc0a3973512c18d6749415920f86dcef1d6a9fae9a0a8b1ef57de6a9c1dbee4b53d86a53d707

    • SSDEEP

      24576:rrbrYF8rnKMoiXCpegUUToqvKgQBZYRmu2fhkoAGes:rrbHmAC0Evz2

    Score
    10/10
    lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks