lokibot

General

Target
4a785dbc6b09f17d9a1975b842a4d34a
Size 463KB
Sample211102-hs782abhd8
SHA256 edce33afb2db3f88d99840bc2000eedcac060c8e506d1f5c99b293f0f6243b28
MD5 4a785dbc6b09f17d9a1975b842a4d34a
SHA1 f395a7fa0c85fa4ad3b35dbf06b3337b4c3a9e70
SHA512 ce67983dad560cb9da28d21bf8750f02b181c6e41ed8ef70473619c2f88f24b86cadc76d1a938c87e8fcf5736bc1d119e145a193f4ebfafad199b9d0c40e3e5c
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://63.250.40.204/~wpdemo/file.php?search=475803
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  4a785dbc6b09f17d9a1975b842a4d34a
- Size 463KB
- SHA256 edce33afb2db3f88d99840bc2000eedcac060c8e506d1f5c99b293f0f6243b28
- MD5 4a785dbc6b09f17d9a1975b842a4d34a
- SHA1 f395a7fa0c85fa4ad3b35dbf06b3337b4c3a9e70
- SHA512 ce67983dad560cb9da28d21bf8750f02b181c6e41ed8ef70473619c2f88f24b86cadc76d1a938c87e8fcf5736bc1d119e145a193f4ebfafad199b9d0c40e3e5c
- MD5 SHA1 SHA512
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2