Overview

overview

10

Static

static

1

71bc06523e...18.msi

windows7-x64

10

71bc06523e...18.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    71bc06523eff20bda9197d0020b751cf_JaffaCakes118

  • Size

    656KB

  • Sample

    241024-bxr92s1apk

  • MD5

    71bc06523eff20bda9197d0020b751cf

  • SHA1

    3215635a506e4c538daa7adcd1606d348d25e0b5

  • SHA256

    165f271fb293701f0b6ab71033eeb9568c18aefcdd847060a3d57475eae2aeed

  • SHA512

    a29e3852395e9fdfc74686b648394ae811eb4b3e14c2592273a765539d844f419a7c505868beb57a858f39f9ae296b16e97ba87562d0662e955fbc73566d6ee0

  • SSDEEP

    6144:EE7TMenVqe/eD8zNa0ILko3H5M1T5DsApiRCDE6YG320A5E7cYDvhRNQ0OBjtguZ:EEXnVqKeDI/ID3HxBuGurTNr2

Score
10/10
lokibotcollectiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

http://spimagesinc.com/images/ImgDump_04-25-16/picture/gallery/newfoldwer/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      71bc06523eff20bda9197d0020b751cf_JaffaCakes118

    • Size

      656KB

    • MD5

      71bc06523eff20bda9197d0020b751cf

    • SHA1

      3215635a506e4c538daa7adcd1606d348d25e0b5

    • SHA256

      165f271fb293701f0b6ab71033eeb9568c18aefcdd847060a3d57475eae2aeed

    • SHA512

      a29e3852395e9fdfc74686b648394ae811eb4b3e14c2592273a765539d844f419a7c505868beb57a858f39f9ae296b16e97ba87562d0662e955fbc73566d6ee0

    • SSDEEP

      6144:EE7TMenVqe/eD8zNa0ILko3H5M1T5DsApiRCDE6YG320A5E7cYDvhRNQ0OBjtguZ:EEXnVqKeDI/ID3HxBuGurTNr2

    Score
    10/10
    lokibotcollectiondiscoverypersistenceprivilege_escalationspywarestealertrojan

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

      trojanspywarestealerlokibot

    • Accesses Microsoft Outlook profiles

      collection

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks