Overview

overview

10

Static

static

3

eae27f51ef...18.exe

windows7-x64

10

eae27f51ef...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eae27f51ef241df09461644766f7c8ab_JaffaCakes118

  • Size

    595KB

  • Sample

    240919-jn9rqsxgqg

  • MD5

    eae27f51ef241df09461644766f7c8ab

  • SHA1

    17ad552fbc80a2cdeefcc11e5146c4945b73cede

  • SHA256

    0863c38d844a42375b3057d52bc75e6d67a3aa202bd5b5e14079929147c68b89

  • SHA512

    2b85b5f0729b229155e2b2d6f7184989a36fa2f81e56b16d3c44d00dae613fa13394560e35ac16d403c01dc03a0f306650b1fd46a33cad66f054ace2351adaff

  • SSDEEP

    12288:7Y2SRgOu9uO2dm4rqoXa3p1m+c9JZUqGWbs:7xSJvObTV37m98qGWI

Score
10/10
lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://edulinkr.com/ol/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      eae27f51ef241df09461644766f7c8ab_JaffaCakes118

    • Size

      595KB

    • MD5

      eae27f51ef241df09461644766f7c8ab

    • SHA1

      17ad552fbc80a2cdeefcc11e5146c4945b73cede

    • SHA256

      0863c38d844a42375b3057d52bc75e6d67a3aa202bd5b5e14079929147c68b89

    • SHA512

      2b85b5f0729b229155e2b2d6f7184989a36fa2f81e56b16d3c44d00dae613fa13394560e35ac16d403c01dc03a0f306650b1fd46a33cad66f054ace2351adaff

    • SSDEEP

      12288:7Y2SRgOu9uO2dm4rqoXa3p1m+c9JZUqGWbs:7xSJvObTV37m98qGWI

    Score
    10/10
    lokibotcollectioncredential_accessdiscoveryspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks