lokibot | 3c67f75826715f15ea6cb25fbb5d689452b9d5ae9252827dac66bfa829279c98

General

Target

3000-20-0x0000000000400000-0x00000000004A2000-memory.dmp
Size

648KB
Sample

241029-mz2r2svcpn
MD5

e35e3a24a7a3338aeb4acae6c8db38bf
SHA1

ca3a943255c52a6576fdeab70f6df5cb077e85d1
SHA256

3c67f75826715f15ea6cb25fbb5d689452b9d5ae9252827dac66bfa829279c98
SHA512

d049a5f5c24ee8f1692252089778798647bb13ca9968030ac6aa4eac0ff8a9f716b819471d3fb99c2146c33e6a8fe41ef25552adf59275080631508303aa3185
SSDEEP

1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

Score

10^/10

lokibot discovery

Malware Config

Extracted

Family

lokibot

C2

http://104.248.205.66/index.php/modify?file=1

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  3000-20-0x0000000000400000-0x00000000004A2000-memory.dmp
- Size
  
  648KB
- MD5
  
  e35e3a24a7a3338aeb4acae6c8db38bf
- SHA1
  
  ca3a943255c52a6576fdeab70f6df5cb077e85d1
- SHA256
  
  3c67f75826715f15ea6cb25fbb5d689452b9d5ae9252827dac66bfa829279c98
- SHA512
  
  d049a5f5c24ee8f1692252089778798647bb13ca9968030ac6aa4eac0ff8a9f716b819471d3fb99c2146c33e6a8fe41ef25552adf59275080631508303aa3185
- SSDEEP
  
  1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2