General

  • Target

    2bd3fce101b8fd12fd61c8c77026ea5d_JaffaCakes118

  • Size

    307KB

  • Sample

    241009-gbbytstglr

  • MD5

    2bd3fce101b8fd12fd61c8c77026ea5d

  • SHA1

    50b985424c4d403ac149520c25868471a7c207cf

  • SHA256

    e02b69d6fbadc67b7e3a589a15d3fd4f7d2ac9f7f1dc720b3f3709e859bc6207

  • SHA512

    de141bdefd36182f42030922128a11aa6b807c63315b02dbdac82025295ff5edaee4bfa0de1cd3190c32f3e1ec03161f524b178831d1204b9b587f51a14466a8

  • SSDEEP

    6144:0D/MMAdkWzhNdallRjumO4DHuFLd10zYrFiSCcaqnqXO0iMyrMKe8U0Q:8lSkuhNdallxuEWrTCPX5fyrM5

Malware Config

Extracted

Family

lokibot

C2

https://avatar.ps/modules/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      ConsoleApp2.exe

    • Size

      369KB

    • MD5

      329693bf1fce73c334b98dedce191db1

    • SHA1

      ddbe13525a6643bc94249079cbd66c00f41235b2

    • SHA256

      9b83e59783b63981f9f85b2939e038531deb96457d91d5d8debc93f396a15272

    • SHA512

      68f54967b9cb5d202e5865aecb27e126419ad88d81483323421b5aafcc5d6d487c6e226230ae16514f1e0ab9e54096a4c4679c75435ae722da8af1ea5ca15d75

    • SSDEEP

      6144:1Tz+HNEq6x2VsOV2tL82F+a6944un6jvgD00B4pC035Ko0TZCjmRx:FyHyx2VsO2L82Qa697un4oBMJKlCSx

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks