lokibot | a2ceeb207e2f03cc956030b5980f833cebbea20c85772374bdee19294d691244

General

Target

JaffaCakes118_a2ceeb207e2f03cc956030b5980f833cebbea20c85772374bdee19294d691244
Size

648KB
Sample

241226-wgw9aatlfp
MD5

250cf428e816b1ad494d1632e7affcac
SHA1

f61160759e46e2d3f56d1a324c37b7db3c8957e3
SHA256

a2ceeb207e2f03cc956030b5980f833cebbea20c85772374bdee19294d691244
SHA512

bec6e3fbeb711d76a0687932f7e506b9d779d0f07433962d731629ffb1ac53c26d821e2aabec402aba39ecef1d1db16dcc43e44ff823c8a9b88cbc389e0f54fd
SSDEEP

1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqqIzmd:nSHIG6mQwGmfOQd8YhY0/EDUG

Score

10^/10

lokibot discovery

Malware Config

Extracted

Family

lokibot

C2

http://qtd8gcdoplav737wretjqmaiy.ga/Basement/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  JaffaCakes118_a2ceeb207e2f03cc956030b5980f833cebbea20c85772374bdee19294d691244
- Size
  
  648KB
- MD5
  
  250cf428e816b1ad494d1632e7affcac
- SHA1
  
  f61160759e46e2d3f56d1a324c37b7db3c8957e3
- SHA256
  
  a2ceeb207e2f03cc956030b5980f833cebbea20c85772374bdee19294d691244
- SHA512
  
  bec6e3fbeb711d76a0687932f7e506b9d779d0f07433962d731629ffb1ac53c26d821e2aabec402aba39ecef1d1db16dcc43e44ff823c8a9b88cbc389e0f54fd
- SSDEEP
  
  1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqqIzmd:nSHIG6mQwGmfOQd8YhY0/EDUG
Score

3^/10

discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2