lokibot

General

Target
vbc.exe
Size 531KB
Sample210125-jyy2axmgps
SHA256 1fb769b269392860ff1951b079f7b8cf4bbe22e09a856e15fbb7a5426aa6a109
MD5 dba3d7f3ca0f9c2d94b4d6830a344c93
SHA1 061757eb4edf849bf231ecd1448d4a04ce2dee81
SHA512 cc24593c24f34993c3c52d74b24543062a52bc1e9fbf022659e5e40b9da2de7b62bc59b68ecc760ce8ab9a4b47785073e48c7bd095d0aceb83b5dd41badfe01b
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://mannaton.com/zoro/zoro3/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  vbc.exe
- Size 531KB
- SHA256 1fb769b269392860ff1951b079f7b8cf4bbe22e09a856e15fbb7a5426aa6a109
- MD5 dba3d7f3ca0f9c2d94b4d6830a344c93
- SHA1 061757eb4edf849bf231ecd1448d4a04ce2dee81
- SHA512 cc24593c24f34993c3c52d74b24543062a52bc1e9fbf022659e5e40b9da2de7b62bc59b68ecc760ce8ab9a4b47785073e48c7bd095d0aceb83b5dd41badfe01b
- MD5 SHA1 SHA512
Score

10^/10

ransomware lokibot spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Executes dropped EXE
- Loads dropped DLL
- Uses the VBS compiler for execution
- Enumerates physical storage devices
  Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

Enumerates physical storage devices

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2