General

  • Target

    JaffaCakes118_e3eadb2ae3da4c0c1aae66144a57c6bf

  • Size

    284KB

  • Sample

    250110-pclhnatmht

  • MD5

    e3eadb2ae3da4c0c1aae66144a57c6bf

  • SHA1

    71f85df87e5a89670faf4c0ab42916f934662b14

  • SHA256

    b956abf18efefee9eefdde9925e2f0d906fd60f0fe33f4b4b312df4877aeffff

  • SHA512

    fd28fab481b56b16f225da17ff5d3207bc6e93c3f2fed3d371ca853b393f0c2ea33cab15fd26ab659867e28679e07c7abe096b64a0f46329210050cff943b28e

  • SSDEEP

    6144:wnfl1dIBXiMWXZT24SGTAYlDvC2zivJDg060759lrtEu:QfqApGuRhvfMgbg59lr

Malware Config

Extracted

Family

lokibot

C2

http://secure01-redirect.net/ga13/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      JaffaCakes118_e3eadb2ae3da4c0c1aae66144a57c6bf

    • Size

      284KB

    • MD5

      e3eadb2ae3da4c0c1aae66144a57c6bf

    • SHA1

      71f85df87e5a89670faf4c0ab42916f934662b14

    • SHA256

      b956abf18efefee9eefdde9925e2f0d906fd60f0fe33f4b4b312df4877aeffff

    • SHA512

      fd28fab481b56b16f225da17ff5d3207bc6e93c3f2fed3d371ca853b393f0c2ea33cab15fd26ab659867e28679e07c7abe096b64a0f46329210050cff943b28e

    • SSDEEP

      6144:wnfl1dIBXiMWXZT24SGTAYlDvC2zivJDg060759lrtEu:QfqApGuRhvfMgbg59lr

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Lokibot family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v15

Tasks