lokibot

General

Target
C56CFBC256132F6C04A193A47EF4949C.exe
Size 488KB
Sample210622-4ctee2e53j
SHA256 95adc30ed6495e078a795b6184442b4147e87e1e48bd040467c0d190cabbf092
MD5 c56cfbc256132f6c04a193a47ef4949c
SHA1 5649611b8d4f5c73c99643e4005ee83c094496ae
SHA512 36b59312073be11d5ca3947ed41e61fed99fe28fe1cdc5f835e741d2bdcd265ff21362833c5ce4cdfc19fd4df3eaa7b55ac699bd724e1f17176c9132d37737fc
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://185.198.57.204/kboy/sync/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  C56CFBC256132F6C04A193A47EF4949C.exe
- Size 488KB
- SHA256 95adc30ed6495e078a795b6184442b4147e87e1e48bd040467c0d190cabbf092
- MD5 c56cfbc256132f6c04a193a47ef4949c
- SHA1 5649611b8d4f5c73c99643e4005ee83c094496ae
- SHA512 36b59312073be11d5ca3947ed41e61fed99fe28fe1cdc5f835e741d2bdcd265ff21362833c5ce4cdfc19fd4df3eaa7b55ac699bd724e1f17176c9132d37737fc
- MD5 SHA1 SHA512
Score

10^/10

lokibot persistence spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2