General

  • Target

    f55ccfb28b593bd7bd036b46f4d54313_JaffaCakes118

  • Size

    114KB

  • Sample

    240925-gwgd2syhpj

  • MD5

    f55ccfb28b593bd7bd036b46f4d54313

  • SHA1

    5805ad53fdf7868711787a2ea9ea0573101a6241

  • SHA256

    006fd5b6d724e35518d042248e5cb7794878e992349fbb0a77461cb5113f47b8

  • SHA512

    94ba387c7c9b80f0eddb3d9dc240e68f7f6f477f539407180730f1ac5c539aa608ee68a89414e7e56a037bc69982ed77f6390bbd270fe108a490b226353f30be

  • SSDEEP

    1536:/V/JokyI2zvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:SIVSHIG6mQwGmfOQd8YhY0/EqUG

Malware Config

Extracted

Family

lokibot

C2

http://youthwinger.com/let/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      f55ccfb28b593bd7bd036b46f4d54313_JaffaCakes118

    • Size

      114KB

    • MD5

      f55ccfb28b593bd7bd036b46f4d54313

    • SHA1

      5805ad53fdf7868711787a2ea9ea0573101a6241

    • SHA256

      006fd5b6d724e35518d042248e5cb7794878e992349fbb0a77461cb5113f47b8

    • SHA512

      94ba387c7c9b80f0eddb3d9dc240e68f7f6f477f539407180730f1ac5c539aa608ee68a89414e7e56a037bc69982ed77f6390bbd270fe108a490b226353f30be

    • SSDEEP

      1536:/V/JokyI2zvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:SIVSHIG6mQwGmfOQd8YhY0/EqUG

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v15

Tasks