lokibot | cacb7a0f02dc33257d647f0eedd40831b7feee5a0a40625a72ed50ee4682f341 | Triage

Sharing

General

Target

cacb7a0f02dc33257d647f0eedd40831b7feee5a0a40625a72ed50ee4682f341.exe
Size

725KB
Sample

200708-myy126v77e
MD5

92b35678cd23f6631f7e91e38a467000
SHA1

dae2070da41597240398120a20ec21115006a974
SHA256

cacb7a0f02dc33257d647f0eedd40831b7feee5a0a40625a72ed50ee4682f341
SHA512

6ee5c10a6622662470bcf9fe9bcbc4892cba0ab1022da9f6a75ae53a3393f775dc6ca42edf7b7603ea51f0d93c9b209dc7ebe52e310027558e76b553ad8af3c0

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

niskioglasi.rs/test1/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  cacb7a0f02dc33257d647f0eedd40831b7feee5a0a40625a72ed50ee4682f341.exe
- Size
  
  725KB
- MD5
  
  92b35678cd23f6631f7e91e38a467000
- SHA1
  
  dae2070da41597240398120a20ec21115006a974
- SHA256
  
  cacb7a0f02dc33257d647f0eedd40831b7feee5a0a40625a72ed50ee4682f341
- SHA512
  
  6ee5c10a6622662470bcf9fe9bcbc4892cba0ab1022da9f6a75ae53a3393f775dc6ca42edf7b7603ea51f0d93c9b209dc7ebe52e310027558e76b553ad8af3c0
Score

10^/10

trojan spyware stealer lokibot
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

trojanspywarestealerlokibot

behavioral2

spywaretrojanstealerlokibot