lokibot | 25afcdd747bb21c3fb9851e23a1ad6c563b0039c2085d0a3e963c57bfd85ab0d

General

Target

1032-114-0x0000000000400000-0x00000000004A2000-memory.dmp
Size

648KB
Sample

241118-whltya1qcz
MD5

838994568298e6a9ed2c3b84f225a7d8
SHA1

c6017a7bd651c993da84cb50c6ac8d7066282c67
SHA256

25afcdd747bb21c3fb9851e23a1ad6c563b0039c2085d0a3e963c57bfd85ab0d
SHA512

1d88b6737ebd26530b482d5c231b56ee949d3024e6cc7668a72014cd6edb817b8c6407cb2213db0f4838ed3d2ad8cb596299c770812797fc2045a8350a38f2ed
SSDEEP

1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqAIzmd:nSHIG6mQwGmfOQd8YhY0/E1UG

Score

10^/10

lokibot discovery

Malware Config

Extracted

Family

lokibot

C2

http://94.156.177.95/simple/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  1032-114-0x0000000000400000-0x00000000004A2000-memory.dmp
- Size
  
  648KB
- MD5
  
  838994568298e6a9ed2c3b84f225a7d8
- SHA1
  
  c6017a7bd651c993da84cb50c6ac8d7066282c67
- SHA256
  
  25afcdd747bb21c3fb9851e23a1ad6c563b0039c2085d0a3e963c57bfd85ab0d
- SHA512
  
  1d88b6737ebd26530b482d5c231b56ee949d3024e6cc7668a72014cd6edb817b8c6407cb2213db0f4838ed3d2ad8cb596299c770812797fc2045a8350a38f2ed
- SSDEEP
  
  1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqAIzmd:nSHIG6mQwGmfOQd8YhY0/E1UG
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2