lokibot | b6d8a117ee127e7709c30a56741871376816f22eb9dd2f24bac74e2c044ebb1f | Triage

Sharing

General

Target

b6d8a117ee127e7709c30a56741871376816f22eb9dd2f24bac74e2c044ebb1f
Size

308KB
Sample

211021-1ajrtsagc7
MD5

980f75cd5958bb2e5189abb0eef978ee
SHA1

9b433878ce2b553c79f6e3c658d51b76ed410e70
SHA256

b6d8a117ee127e7709c30a56741871376816f22eb9dd2f24bac74e2c044ebb1f
SHA512

6a2e8a33d6137c552cc6fb0a19660b6a2353909de7fe7f8ce134f25daf086889cb429894960d09ec558e08bc7e106d08ce2bce332542196b6af4d37e3af0fc10

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://checkvim.com/ga14/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  b6d8a117ee127e7709c30a56741871376816f22eb9dd2f24bac74e2c044ebb1f
- Size
  
  308KB
- MD5
  
  980f75cd5958bb2e5189abb0eef978ee
- SHA1
  
  9b433878ce2b553c79f6e3c658d51b76ed410e70
- SHA256
  
  b6d8a117ee127e7709c30a56741871376816f22eb9dd2f24bac74e2c044ebb1f
- SHA512
  
  6a2e8a33d6137c552cc6fb0a19660b6a2353909de7fe7f8ce134f25daf086889cb429894960d09ec558e08bc7e106d08ce2bce332542196b6af4d37e3af0fc10
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

lokibotcollectionspywarestealertrojan