lokibot

General

Target
AB1CEF822F66D7B77574A21C8154D4A6E9FCD196A6659.exe
Size 488KB
Sample210622-ncfm32tlfn
SHA256 ab1cef822f66d7b77574a21c8154d4a6e9fcd196a6659637f1d662f0ef7df3bd
MD5 4f1000a03f782677440b67a61ef3930b
SHA1 258023292effb0a0f1ad10ab34efe380eca746f1
SHA512 4cf52010ba0d9246d8bd7d8be6fdb7493226ecc547ef69980ec81196af0e0b5b6833ac0d8ec60a6fe33a88e48ad9b882773cf87610641bc437fae0ee96d7a9ce
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://185.198.57.204/kboy/sync/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  AB1CEF822F66D7B77574A21C8154D4A6E9FCD196A6659.exe
- Size 488KB
- SHA256 ab1cef822f66d7b77574a21c8154d4a6e9fcd196a6659637f1d662f0ef7df3bd
- MD5 4f1000a03f782677440b67a61ef3930b
- SHA1 258023292effb0a0f1ad10ab34efe380eca746f1
- SHA512 4cf52010ba0d9246d8bd7d8be6fdb7493226ecc547ef69980ec81196af0e0b5b6833ac0d8ec60a6fe33a88e48ad9b882773cf87610641bc437fae0ee96d7a9ce
- MD5 SHA1 SHA512
Score

10^/10

lokibot persistence spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2