General
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://196.251.92.64/crypt/Devil.exe
Resource
win10v2004-20250217-en
19 signatures
300 seconds
Malware Config
Extracted
Family
lokibot
C2
https://rottot.shop/Devil/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
http://196.251.92.64/crypt/Devil.exe
-
Lokibot family
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1