lokibot

General

Target

STEEL S.p.A. Urgent Quotation July 2020.exe
Size

566KB
Sample

200709-6qdwjb7ake
MD5

0702f9fe3c20240759c91bd61eb99abb
SHA1

b53968eda278e768d22b3d183762b2b4f04d5b09
SHA256

2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3
SHA512

3284216d43cc8b8212c030829447e6b9c36207a1150f02b554c16e9f66549ec13a3590c45de83f9bda15388503cfc09ebfefbdfa9b2f45ad1f773c101642b7e0

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://colorlux.ro/color/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  STEEL S.p.A. Urgent Quotation July 2020.exe
- Size
  
  566KB
- MD5
  
  0702f9fe3c20240759c91bd61eb99abb
- SHA1
  
  b53968eda278e768d22b3d183762b2b4f04d5b09
- SHA256
  
  2c6c652ef92137233f5d0a9e8fde19521900a92d2df7c617ca822dd1e70412c3
- SHA512
  
  3284216d43cc8b8212c030829447e6b9c36207a1150f02b554c16e9f66549ec13a3590c45de83f9bda15388503cfc09ebfefbdfa9b2f45ad1f773c101642b7e0
Score

10^/10

spyware trojan stealer lokibot
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2