lokibot | 80eb6068e2b99d155414e44e0422f85e8f214bf3563425fd82d63f538b964370

General

Target

3016-21-0x0000000000400000-0x00000000004A2000-memory.dmp
Size

648KB
Sample

241029-jgk5ssxbpc
MD5

66aac64a567c7cd0b31a5b92b37f7b4f
SHA1

1c8dc9b1badd84c1a89684a97bf98068635b6072
SHA256

80eb6068e2b99d155414e44e0422f85e8f214bf3563425fd82d63f538b964370
SHA512

c8f87667923d77bf55e39e2fe066a0371b1be68ca8e4be6d5511f669f8df8da59cdfa59eac0ae916d2f884d3fe090bbda41677f84d30c06503ddebd3e2aef0ac
SSDEEP

1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqsIzmd:nSHIG6mQwGmfOQd8YhY0/EZUG

Score

10^/10

lokibot discovery

Malware Config

Extracted

Family

lokibot

C2

https://ghcopz.shop/ClarkB/PWS/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  3016-21-0x0000000000400000-0x00000000004A2000-memory.dmp
- Size
  
  648KB
- MD5
  
  66aac64a567c7cd0b31a5b92b37f7b4f
- SHA1
  
  1c8dc9b1badd84c1a89684a97bf98068635b6072
- SHA256
  
  80eb6068e2b99d155414e44e0422f85e8f214bf3563425fd82d63f538b964370
- SHA512
  
  c8f87667923d77bf55e39e2fe066a0371b1be68ca8e4be6d5511f669f8df8da59cdfa59eac0ae916d2f884d3fe090bbda41677f84d30c06503ddebd3e2aef0ac
- SSDEEP
  
  1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqsIzmd:nSHIG6mQwGmfOQd8YhY0/EZUG
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2