General
-
Target
Devil.exe
-
Size
104KB
-
Sample
250211-jvxezs1kcz
-
MD5
eb6beba0181a014ac8c0ec040cb1121a
-
SHA1
52805384c7cd1b73944525c480792a3d0319b116
-
SHA256
f87b4e7c69ce161743f4b9b0001d7376e163d615ce477c390f63cadf09ffc5d4
-
SHA512
0afb9a7d180fe017520afb39e954821f77c8b6e2e11bbf73402dcdade231d07f3b755f40606252c917b51a0f5f32d499b96b30e7f2f617c50e709eae4cd80ae4
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
Behavioral task
behavioral1
Sample
Devil.exe
Resource
win7-20241010-en
Malware Config
Extracted
lokibot
https://rottot.shop/Devil/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Devil.exe
-
Size
104KB
-
MD5
eb6beba0181a014ac8c0ec040cb1121a
-
SHA1
52805384c7cd1b73944525c480792a3d0319b116
-
SHA256
f87b4e7c69ce161743f4b9b0001d7376e163d615ce477c390f63cadf09ffc5d4
-
SHA512
0afb9a7d180fe017520afb39e954821f77c8b6e2e11bbf73402dcdade231d07f3b755f40606252c917b51a0f5f32d499b96b30e7f2f617c50e709eae4cd80ae4
-
SSDEEP
1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG
-
Lokibot family
-
Downloads MZ/PE file
-
Accesses Microsoft Outlook profiles
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1