lokibot

General

Target

Payment Copy.exe
Size

675KB
Sample

200707-ly28zlgh1a
MD5

f6e19104e5ed3c54df87b72849134b60
SHA1

83089ca9e22e9f451e17104a46bcf3d73c945a31
SHA256

52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05
SHA512

b43d21f8e3d150e3cb5d8d3cef51ed13d577d197f5da4a7ca658ebc9df84eb71f60e83c697472f8a0dc10c002c705ee7c39cfd524f910e10d5cafe65d0341b33

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://acpanode-sg.com/stanz/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Payment Copy.exe
- Size
  
  675KB
- MD5
  
  f6e19104e5ed3c54df87b72849134b60
- SHA1
  
  83089ca9e22e9f451e17104a46bcf3d73c945a31
- SHA256
  
  52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05
- SHA512
  
  b43d21f8e3d150e3cb5d8d3cef51ed13d577d197f5da4a7ca658ebc9df84eb71f60e83c697472f8a0dc10c002c705ee7c39cfd524f910e10d5cafe65d0341b33
Score

10^/10

spyware trojan stealer lokibot
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2