lokibot

General

Target

f21bd0097650027161d5724a41f4870d403324c5a73128817ef2652c0b9c1fac.exe
Size

318KB
Sample

200708-rx55kd1c6x
MD5

daaada1d9050881cd8ccd6370f1747be
SHA1

7ac59b0dea887600cf791721d15be064ec2eecc8
SHA256

f21bd0097650027161d5724a41f4870d403324c5a73128817ef2652c0b9c1fac
SHA512

2b5fb952060b047a062d370e5fa75a5b419b68f55b2b35a01a58975c7bfbe6c9e2d67d5e80b1f284b6d487fc73f16ccab14d5229cb10ece1d32044cf865e1a35

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://79.124.8.8/plesk-site-preview/chongelctricals.com/http/79.124.8.8/adamsn/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  f21bd0097650027161d5724a41f4870d403324c5a73128817ef2652c0b9c1fac.exe
- Size
  
  318KB
- MD5
  
  daaada1d9050881cd8ccd6370f1747be
- SHA1
  
  7ac59b0dea887600cf791721d15be064ec2eecc8
- SHA256
  
  f21bd0097650027161d5724a41f4870d403324c5a73128817ef2652c0b9c1fac
- SHA512
  
  2b5fb952060b047a062d370e5fa75a5b419b68f55b2b35a01a58975c7bfbe6c9e2d67d5e80b1f284b6d487fc73f16ccab14d5229cb10ece1d32044cf865e1a35
Score

10^/10

spyware trojan stealer lokibot
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2