lokibot | e0b5a7aa2ae1c4df12a5fa90c2f68c615690a58d80af00ff60ed5d7ab30c2f46 | Triage

Sharing

General

Target

Revised Proforma Invoice_pdf.exe
Size

565KB
Sample

200709-7vv6v5rqye
MD5

7911d0a635c65f04715e876447a1a73d
SHA1

21a7079f28dd1aa6e7c8baba7eda70ebc3f7e337
SHA256

e0b5a7aa2ae1c4df12a5fa90c2f68c615690a58d80af00ff60ed5d7ab30c2f46
SHA512

9e8b924ace5cb2f24908dcaacd83f2bd20acbff147b5fec92776838c188f624490004922f7011fe1da89e2a14bd4f09815dafb52de545ce03eb2354822b7787d

Score

10^/10

lokibot spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

niskioglasi.rs/test2/Panel/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Revised Proforma Invoice_pdf.exe
- Size
  
  565KB
- MD5
  
  7911d0a635c65f04715e876447a1a73d
- SHA1
  
  21a7079f28dd1aa6e7c8baba7eda70ebc3f7e337
- SHA256
  
  e0b5a7aa2ae1c4df12a5fa90c2f68c615690a58d80af00ff60ed5d7ab30c2f46
- SHA512
  
  9e8b924ace5cb2f24908dcaacd83f2bd20acbff147b5fec92776838c188f624490004922f7011fe1da89e2a14bd4f09815dafb52de545ce03eb2354822b7787d
Score

10^/10

spyware trojan stealer lokibot
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

spywaretrojanstealerlokibot

behavioral2

spywaretrojanstealerlokibot