lokibot

General

Target
41c7a84edea3aed7716f275742a3b11e
Size 357KB
Sample211020-h7s3naggb2
SHA256 89658fee4b1a9799ebf59268e6cacc696d326cd97afaa5cc0d1592846fc2f5f3
MD5 41c7a84edea3aed7716f275742a3b11e
SHA1 df58f3c713c79a1b93494209c2dc7616aa5347df
SHA512 b8443b8d5f2d0dd6518c18a4d0c6273c059a4f2de68d06cc1f74cd0846ff557a8ab9bca72cb6742dfb538f6b84cc7177aea2c059b3a630d69472a1533b50475a
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://63.250.40.204/~wpdemo/file.php?search=475803
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  41c7a84edea3aed7716f275742a3b11e
- Size 357KB
- SHA256 89658fee4b1a9799ebf59268e6cacc696d326cd97afaa5cc0d1592846fc2f5f3
- MD5 41c7a84edea3aed7716f275742a3b11e
- SHA1 df58f3c713c79a1b93494209c2dc7616aa5347df
- SHA512 b8443b8d5f2d0dd6518c18a4d0c6273c059a4f2de68d06cc1f74cd0846ff557a8ab9bca72cb6742dfb538f6b84cc7177aea2c059b3a630d69472a1533b50475a
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2