General
-
Target
JaffaCakes118_9874f21e0e3ee7dd020434173334e191
-
Size
345KB
-
Sample
250108-nbnqyszlgq
-
MD5
9874f21e0e3ee7dd020434173334e191
-
SHA1
5a4a29b0980ea0b5b42da76d878102bf7a00807e
-
SHA256
ce7e05df71270d0aed71ab8af1de1f152fbdfeb10d781fe26e3f8c58c3fa899a
-
SHA512
88bf864d828a6dc1b5d4eb151e96d3032c4e4453fe50b377faf7670265e840105ca6f93c0dc710415695179989c437b5517722f796041cb70d0f842e6651ec23
-
SSDEEP
6144:XrydTW3AHIooGEArx3i6VaiGuBKIugXd2qP4XTMDV/xkAkLOoT:XGdKQHIoTEArDQNIugXd2qPaMDV5kvD
Static task
static1
Malware Config
Extracted
lokibot
http://secure01-redirect.net/ga13/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
JaffaCakes118_9874f21e0e3ee7dd020434173334e191
-
Size
345KB
-
MD5
9874f21e0e3ee7dd020434173334e191
-
SHA1
5a4a29b0980ea0b5b42da76d878102bf7a00807e
-
SHA256
ce7e05df71270d0aed71ab8af1de1f152fbdfeb10d781fe26e3f8c58c3fa899a
-
SHA512
88bf864d828a6dc1b5d4eb151e96d3032c4e4453fe50b377faf7670265e840105ca6f93c0dc710415695179989c437b5517722f796041cb70d0f842e6651ec23
-
SSDEEP
6144:XrydTW3AHIooGEArx3i6VaiGuBKIugXd2qP4XTMDV/xkAkLOoT:XGdKQHIoTEArDQNIugXd2qPaMDV5kvD
-
Lokibot family
-
Accesses Microsoft Outlook profiles
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1