lokibot | 5b3e436dde61073e23c45d375871695ef28011d2436cf3ad6ec69ffd9f324e76 | Triage

Sharing

General

Target

5b3e436dde61073e23c45d375871695ef28011d2436cf3ad6ec69ffd9f324e76.exe
Size

565KB
Sample

200529-sqk98cj6as
MD5

02d677241a3cc7ffef81dbb97d7ae9fc
SHA1

ed4786d7923a8551cc14e31d065f75ba7dc2abae
SHA256

5b3e436dde61073e23c45d375871695ef28011d2436cf3ad6ec69ffd9f324e76
SHA512

058974138ec8d87f13871551d67f005a94f09dafe57d668201f0fd494dec368ff8594c903ecce11f6985ce865490b01a24ff6193b583964960f9ec431318e913

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://apoxnew.com/36k/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  5b3e436dde61073e23c45d375871695ef28011d2436cf3ad6ec69ffd9f324e76.exe
- Size
  
  565KB
- MD5
  
  02d677241a3cc7ffef81dbb97d7ae9fc
- SHA1
  
  ed4786d7923a8551cc14e31d065f75ba7dc2abae
- SHA256
  
  5b3e436dde61073e23c45d375871695ef28011d2436cf3ad6ec69ffd9f324e76
- SHA512
  
  058974138ec8d87f13871551d67f005a94f09dafe57d668201f0fd494dec368ff8594c903ecce11f6985ce865490b01a24ff6193b583964960f9ec431318e913
Score

10^/10

trojan spyware stealer lokibot
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

trojanspywarestealerlokibot

behavioral2

trojanspywarestealerlokibot