lokibot | 2447eb9572ac10a9daacaad16bf8f4f922041849c0a570cdeb8724ea9285aac6 | Triage

Sharing

General

Target

2447eb9572ac10a9daacaad16bf8f4f922041849c0a570cdeb8724ea9285aac6
Size

372KB
Sample

211021-1akdcsagd4
MD5

0929fb7f0a76cd563c16ba1b3303dcb4
SHA1

f6f59694512fae49eab172778ef51ee4877afd61
SHA256

2447eb9572ac10a9daacaad16bf8f4f922041849c0a570cdeb8724ea9285aac6
SHA512

ea9c51541cf56bc7e8539191f6869fd4e1d670a8cf9d8c1dcc4695f6cd53dc6fae42a03e4c480acc5ffe6749ccafab66d5dc41ece08dca806f32b0500b507c48

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://secure01-redirect.net/fd4/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  2447eb9572ac10a9daacaad16bf8f4f922041849c0a570cdeb8724ea9285aac6
- Size
  
  372KB
- MD5
  
  0929fb7f0a76cd563c16ba1b3303dcb4
- SHA1
  
  f6f59694512fae49eab172778ef51ee4877afd61
- SHA256
  
  2447eb9572ac10a9daacaad16bf8f4f922041849c0a570cdeb8724ea9285aac6
- SHA512
  
  ea9c51541cf56bc7e8539191f6869fd4e1d670a8cf9d8c1dcc4695f6cd53dc6fae42a03e4c480acc5ffe6749ccafab66d5dc41ece08dca806f32b0500b507c48
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

lokibotcollectionspywarestealertrojan