lokibot

General

Target

INV09072020PO400596.exe
Size

355KB
Sample

200709-3m5fg3phb2
MD5

36c12aba9b24e41321b132896b3b0828
SHA1

2c5655f67cffbcdbf96afea40fca7dd9af445825
SHA256

5866468d4084d09ee1b47f5135e8968923581b6f6fb5bacaed97b0e3da3a6999
SHA512

58899ac35b6601e4901157fcb84e1d43500825372fe53b4defa29c2c91140965edd4bfc998aa3eea882a6dee5bd175044f166d4e27d66d1f5714b452e437e3d1

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://modevin.ga/~zadmin/lmark/frega3/mode.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  INV09072020PO400596.exe
- Size
  
  355KB
- MD5
  
  36c12aba9b24e41321b132896b3b0828
- SHA1
  
  2c5655f67cffbcdbf96afea40fca7dd9af445825
- SHA256
  
  5866468d4084d09ee1b47f5135e8968923581b6f6fb5bacaed97b0e3da3a6999
- SHA512
  
  58899ac35b6601e4901157fcb84e1d43500825372fe53b4defa29c2c91140965edd4bfc998aa3eea882a6dee5bd175044f166d4e27d66d1f5714b452e437e3d1
Score

10^/10

spyware trojan stealer lokibot
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Blacklisted process makes network request
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blacklisted process makes network request

Loads dropped DLL

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2