lokibot

General

Target

Customers Requirment_pdf .scr.exe
Size

425KB
Sample

200714-9zkkc3zaaa
MD5

5bf14fa31940ec3bd25065d3d51fe36d
SHA1

d7f52b052c34b5a3a123b9812fc296fd25e75cfd
SHA256

7e0b697ca060ceb919fa17715a88ffe9cf8ad66e3e95a720400f27777fbed132
SHA512

91dccb46548cfe993efb7bfb263698a545d47385538416bf160457ea019f8880d8fddf072a8d4594749fba7c313f1a6419cdb5d78b37e724087a5dfdbcced56c

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://195.69.140.147/.op/cr.php/XGfxkVvZa76tV

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  Customers Requirment_pdf .scr.exe
- Size
  
  425KB
- MD5
  
  5bf14fa31940ec3bd25065d3d51fe36d
- SHA1
  
  d7f52b052c34b5a3a123b9812fc296fd25e75cfd
- SHA256
  
  7e0b697ca060ceb919fa17715a88ffe9cf8ad66e3e95a720400f27777fbed132
- SHA512
  
  91dccb46548cfe993efb7bfb263698a545d47385538416bf160457ea019f8880d8fddf072a8d4594749fba7c313f1a6419cdb5d78b37e724087a5dfdbcced56c
Score

10^/10

lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2