lokibot | 86e6f9a2f63058ab6e8508ef4f19041c27bc32951f162e47fa69dced6a4a4f21

General

Target

JaffaCakes118_86e6f9a2f63058ab6e8508ef4f19041c27bc32951f162e47fa69dced6a4a4f21
Size

648KB
Sample

241222-nlv8sawraq
MD5

f914e93a467c456c2141d5d2d2db2d27
SHA1

c0397acf8c80b42ccabae528ddec9ea64a30b972
SHA256

86e6f9a2f63058ab6e8508ef4f19041c27bc32951f162e47fa69dced6a4a4f21
SHA512

ed8340ca866fc28e7b0c4882a41fe929f1ec6056e4f2d333b7711bd02781e20916f6c72516db91aadcb93941585199cde56ffedce1789027bd02fdfd830e58e4
SSDEEP

1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqDIzmd:nSHIG6mQwGmfOQd8YhY0/EmUG

Score

10^/10

lokibot discovery

Malware Config

Extracted

Family

lokibot

C2

http://sempersim.su/gf9/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  JaffaCakes118_86e6f9a2f63058ab6e8508ef4f19041c27bc32951f162e47fa69dced6a4a4f21
- Size
  
  648KB
- MD5
  
  f914e93a467c456c2141d5d2d2db2d27
- SHA1
  
  c0397acf8c80b42ccabae528ddec9ea64a30b972
- SHA256
  
  86e6f9a2f63058ab6e8508ef4f19041c27bc32951f162e47fa69dced6a4a4f21
- SHA512
  
  ed8340ca866fc28e7b0c4882a41fe929f1ec6056e4f2d333b7711bd02781e20916f6c72516db91aadcb93941585199cde56ffedce1789027bd02fdfd830e58e4
- SSDEEP
  
  1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqDIzmd:nSHIG6mQwGmfOQd8YhY0/EmUG
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2