Overview

overview

10

Static

static

3

f4d88e9cc5...18.exe

windows7-x64

10

f4d88e9cc5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4d88e9cc556ca0c234310293ac5b037_JaffaCakes118

  • Size

    387KB

  • Sample

    240925-bjfzvswbnq

  • MD5

    f4d88e9cc556ca0c234310293ac5b037

  • SHA1

    f452b5bdbc4d7a08764dae470a89272061e6eb8a

  • SHA256

    a937d51e08c3cf899d69d9e0d7d4f63c2bb82df4760054107eae1a2f6d189b08

  • SHA512

    a3bfa82f8133fe3159b95868cba40207693ed50dbec34f072ed96797f9e3f3106a746ec28e18e42b8ae16e3de1fcd6c5522b8886d2b1645cb2addad2e90f46d4

  • SSDEEP

    3072:i5UC3t0HIParaeW/qkXKDPMO5Mp8y3MReAG6ZDd2eIcz3BdMz6I72Owzu:0Uct00iPAXCl5MWyWekuCImIBwu

Score
10/10
lokibotcollectiondiscoveryspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://ipqbook.com/glory/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      f4d88e9cc556ca0c234310293ac5b037_JaffaCakes118

    • Size

      387KB

    • MD5

      f4d88e9cc556ca0c234310293ac5b037

    • SHA1

      f452b5bdbc4d7a08764dae470a89272061e6eb8a

    • SHA256

      a937d51e08c3cf899d69d9e0d7d4f63c2bb82df4760054107eae1a2f6d189b08

    • SHA512

      a3bfa82f8133fe3159b95868cba40207693ed50dbec34f072ed96797f9e3f3106a746ec28e18e42b8ae16e3de1fcd6c5522b8886d2b1645cb2addad2e90f46d4

    • SSDEEP

      3072:i5UC3t0HIParaeW/qkXKDPMO5Mp8y3MReAG6ZDd2eIcz3BdMz6I72Owzu:0Uct00iPAXCl5MWyWekuCImIBwu

    Score
    10/10
    lokibotcollectiondiscoveryspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks